{ "Event": { "published": true, "date": "2021-04-02", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-04-02", "timestamp": 1617408182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "87743280-6e97-4382-b6f4-1f8dae60f773", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa9a6d6-93a6-11eb-abe1-42010a9c0039", "comment": "Malware payload (CobaltStrike)", "timestamp": 1617362718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362718, "uuid": "35f98077-5ce8-41b6-9cb4-a29215d7115c", "comment": "Malware payload (CobaltStrike)", "value": "37917d4d7b15100e27caf5b7629f8d55", "object_relation": "md5", "Tag": [ { "name": "99.81.122.12", "colour": "#6905C0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362718, "uuid": "0e055268-72db-48d4-88b7-9372a90e24bd", "comment": "Malware payload (CobaltStrike)", "value": "006a11f8090084358245f61fc8f850a3b498233ce73eecd59318d5b75e48dfed", "object_relation": "sha256", "Tag": [ { "name": "99.81.122.12", "colour": "#6905C0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362718, "uuid": "ec051b4f-d922-4aed-8eba-8a91683039b4", "comment": "Malware payload (CobaltStrike)", "value": "e71a89926ae816f0a9e2a1a520ece80720b59c87", "object_relation": "sha1", "Tag": [ { "name": "99.81.122.12", "colour": "#6905C0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362718, "uuid": "773a8e87-045b-43e2-8e64-7fd8d9b74d51", "comment": "Malware payload (CobaltStrike)", "value": "02ffeb4d6742962ae98fd96c557a4a55823800ff6cf8ed0c2b5bcfea1b9a94d2a12d5d96a9555c5c02b58bae5c34153f", "object_relation": "sha3-384", "Tag": [ { "name": "99.81.122.12", "colour": "#6905C0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362718, "uuid": "b38222c9-d469-4178-8c2c-64bc56d5e727", "value": "8682F97FB60264D8C127D17C88EE6771ACF27422417B6B1F2BB8D7342E219784A6D909", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362718, "uuid": "1c124e5f-ba43-48d4-80b8-0542c2b73bb0", "value": "17b461a082950fc6332228572138b80c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362718, "uuid": "3a3ebe2f-d961-40bb-ab7b-f44e54df0f58", "value": "192:aYA0TJAPyjLHY219R8C6wtQbYu2KmbxQ2C04kvWgepEt2NtCmj6EUbOD6kxiY:xA0TJASPp6p/D43FvWgepBtCK6IAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617362718, "uuid": "e0cc5df7-bb2d-420b-a17a-68c656a15e41", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617362718, "uuid": "26b20171-b271-46dd-8376-b07d261345ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362718, "uuid": "8ac95849-ff5f-4aad-876c-5381e2a347c0", "value": "006a11f8090084358245f61fc8f850a3b498233ce73eecd59318d5b75e48dfed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ce70b8-939b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1617358068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358068, "uuid": "52c420bc-a6f0-4463-a3de-8668f1f3db6f", "comment": "Malware payload (AsyncRAT)", "value": "f0a3e284aaf57665c35ed9ab959cf33a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358068, "uuid": "b3c49e7f-d019-4d1f-a4cd-0eadeb91e37d", "comment": "Malware payload (AsyncRAT)", "value": "011254af2259c53958486ea1e8d49f59539a8f7143c94891d0c61e249b20b389", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358068, "uuid": "d2abd9b2-13f6-4571-ae4d-59a0306804a5", "comment": "Malware payload (AsyncRAT)", "value": "235143a5c7d30e03394a66e11533241b33d0c838", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358068, "uuid": "07342342-9aea-4e75-b398-15c0a7b0bd23", "comment": "Malware payload (AsyncRAT)", "value": "eb56dc2e1f7b821219c2f17c0e9a9984473d2461a2583c46cf8d92b8b7cee6a4c7d6d8fe8afdbf00b8c1cd56c55893fe", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358068, "uuid": "aa9bbcd5-07b2-4960-82b7-5cd205470cfb", "value": "E80412E15D00CBE0B4A45AC4FEA22381B5A782CDA23C613579A9D6016FB97737CFA534", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358068, "uuid": "e41197d8-2a58-4397-beb7-89dd51c5a729", "value": "3072:jAgDVxB6ySWuqEgrRQbTLyvgf2z8NSb157mJbbNaw6Q8uGFSKu4WL+eVPyTlL8nc:jJDHBrSAX1Q/m42gNe4HNP6Q8eKuNLlM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617358068, "uuid": "4fb9b4ef-db02-4141-a23c-d021f5d3d089", "value": 175283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617358068, "uuid": "9378f063-2b23-47e8-9c76-c20feb747d14", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358068, "uuid": "4e06e713-e821-4b2a-a186-e5cc10891d37", "value": "SCAN_0395985.PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8967a669-93be-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617373212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617373212, "uuid": "325d7db5-69d1-4dec-b2bb-501bf760d867", "comment": "Malware payload (Dridex)", "value": "04804859d567526c4374b9819c8964f0", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617373212, "uuid": "9312c1ea-ecfa-49b3-a865-68fad9b5be61", "comment": "Malware payload (Dridex)", "value": "018ee2c70c7ceb8b6d0c8d41e20cdb48b9a0e635db54ea33dc6f4ccb351aac6d", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617373212, "uuid": "dd467b75-fbfe-4a74-9aa8-736dfd36ce5c", "comment": "Malware payload (Dridex)", "value": "7d56124f95d917d6bba5f4631117e786e8398cee", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617373212, "uuid": "618c6b06-bb0d-44b2-ac13-65e84d70434b", "comment": "Malware payload (Dridex)", "value": "b500818abd735bd523242a7d91a206f4021c4a31104aa5b7068f6e75e8b174dc8448a7abe8443dd74e98568e1b79342c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617373212, "uuid": "29170dd3-667a-4b33-925c-73e8bd73af12", "value": "AF14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617373212, "uuid": "38cfa4da-52b5-4a3a-bf86-89ffb3a94394", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617373212, "uuid": "09092f06-604e-4551-8965-df7a572283db", "value": "3072:iopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:1pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617373212, "uuid": "f28006d5-db3f-4fd6-b490-3db3c466a920", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617373212, "uuid": "63098b3e-5fca-46f9-aae1-3fd9f970ac7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617373212, "uuid": "2dea4453-3bb4-46ee-8493-1af84b6b4c9d", "value": "018ee2c70c7ceb8b6d0c8d41e20cdb48b9a0e635db54ea33dc6f4ccb351aac6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167af9e3-9381-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617346820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346820, "uuid": "0d2ad95c-9767-4395-a1ef-d80b7e6946ee", "comment": "Malware payload (Dridex)", "value": "b8f5df7a08709946214b743793979a94", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346820, "uuid": "e1e4853c-f9b2-4036-bf00-5e84f37edcbe", "comment": "Malware payload (Dridex)", "value": "01f2534405cbcd8b028fb91e479281d94880ceb9c5309fe918352def710bbe17", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346820, "uuid": "71409178-b9b4-42b5-9224-c0fd79e0d1a6", "comment": "Malware payload (Dridex)", "value": "5c4f2f3e3e9bedd5973295e609a5c223ce164489", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346820, "uuid": "df3862de-190d-4938-950f-31efdce61017", "comment": "Malware payload (Dridex)", "value": "9d9340ea2fd042c77e199f940fdb0c8d4ae909e47bf325d51ec14d1cc7831a4c9958adddaf3ba019058d98185361da3b", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346820, "uuid": "817dfbd3-63b5-4d59-9c4d-0201a4be274e", "value": "7414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346820, "uuid": "ed1b934f-7cb8-4451-aa6b-495aa32108df", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346820, "uuid": "c68a731f-c037-4832-91a8-8d6bc65f0b7f", "value": "3072:Yopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:PpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617346820, "uuid": "11727ea3-eaa7-4056-a13d-baad2fffaab2", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617346820, "uuid": "e34aef7e-359f-4e17-b9e2-5d7f5eab5cb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346820, "uuid": "d4c0ff08-efbc-4e97-a00b-2df9f26c231c", "value": "01f2534405cbcd8b028fb91e479281d94880ceb9c5309fe918352def710bbe17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54581b2-939b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617358280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358280, "uuid": "1bff03cb-b669-4dc6-965b-250cd68a839a", "comment": "Malware payload (Formbook)", "value": "274b50245149a72ab3f2183a1e6ed31a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358280, "uuid": "76d55592-227b-476d-b4ce-8eed548101e2", "comment": "Malware payload (Formbook)", "value": "02080770795f6e02626b574c8d35f8e66178a17f431adeed7108b98279c73a21", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358280, "uuid": "415c0ab1-ac79-4061-9955-94669b7b3b64", "comment": "Malware payload (Formbook)", "value": "06528c99df421ed11ab8f49c3980848e20604df2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358280, "uuid": "a3a2ce4d-92e0-4465-afa1-324f3d03f476", "comment": "Malware payload (Formbook)", "value": "e02631f930ad31508cd90eb45162e925b88eef0ad190045a6d85fe050b85172541968da5b88a2df39d04555397b91775", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358280, "uuid": "74832f8a-88c6-4b94-a82f-27e0c9859caf", "value": "E994BFA1FC4B6962C0464B7364068F345A234F941159AD2216902FB73A1F68FFEBD36F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358280, "uuid": "bbce781d-9ef1-4625-b636-8240d6652f7b", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358280, "uuid": "ef2f32a8-eeae-4196-97fa-48b348a75690", "value": "6144:K9X0GhtUFba2QF26gKQ+FyvxhQuHzm8N838WIVDqWonl5qkIs2:80ctUMroxhQuC8aSVGW0lokIs2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617358280, "uuid": "2e3be1f2-b533-47e9-8123-6e16ef9b43a7", "value": 416388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617358280, "uuid": "93cc101d-3184-4cf4-8aca-b30ad33af86b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358280, "uuid": "c0b2450f-dcda-4157-9f09-86ae5235aa8c", "value": "New Month.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86ee16a-9380-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617346662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346662, "uuid": "ac6a2670-279e-4b8f-ac78-039e77b9e70e", "comment": "Malware payload (Gozi)", "value": "c550d2738b5bc49c86523ccdbae72ffa", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346662, "uuid": "26a106f9-863f-413d-bdee-9d28cc29e97d", "comment": "Malware payload (Gozi)", "value": "021d8c6fb2fc62ce020734ca5bf9327668470a643dfc621aed6f4e2ad7b14575", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346662, "uuid": "db68836a-cc78-43bf-8b5a-8539621b60e4", "comment": "Malware payload (Gozi)", "value": "9765307e6a5d9444fe1948376eba68e2972ba263", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346662, "uuid": "8c06de2a-f3f9-49f9-9e3c-d9f23fc659d5", "comment": "Malware payload (Gozi)", "value": "135a524c5238e3c218c915d138b8214177e3ca3c0a07d423d292f11191db527ac9954a588f6ad82aa69fe8ab7b810214", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346662, "uuid": "9812c525-1738-4991-88f3-68071002d514", "value": "0683120FB46D772C9D1321DC0390248D26AFE6A348F46459E3EBCB47C8E79A65290E64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346662, "uuid": "05f1ae82-c491-4a55-b391-eb1f23f9a278", "value": "1536:z29YEedxA9TBV9EtvLABkxdbUVloqv+w3ZBUQkZE4FhjcnMrV/TlFANY:SSEePA9TBVCvskx1wDvr3IQkH8oVLlmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617346662, "uuid": "da59d142-fc2c-4323-9ee7-afffd17a527c", "value": 86908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617346662, "uuid": "9af116bd-2b39-4602-8497-c9627cf53fbb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346662, "uuid": "e55ed680-385b-4fdd-a59d-6e170342edb5", "value": "request_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5293e9-93a5-11eb-abe1-42010a9c0039", "comment": "Malware payload (CobaltStrike)", "timestamp": 1617362644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362644, "uuid": "5d6f6dac-7c38-47d0-ad6a-4d4ed4eefdc5", "comment": "Malware payload (CobaltStrike)", "value": "4dc4c87ea39e214700a045e0d9190852", "object_relation": "md5", "Tag": [ { "name": "213.227.154.6", "colour": "#296310", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362644, "uuid": "e28a14eb-1488-450e-a56b-55b6555ab464", "comment": "Malware payload (CobaltStrike)", "value": "023cff6801f8909f19d3c66e3ad286f6bb84a6b4f518bfac3d44026318fa8775", "object_relation": "sha256", "Tag": [ { "name": "213.227.154.6", "colour": "#296310", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362644, "uuid": "f48b56c6-71d3-4499-aaab-48f0772f81fe", "comment": "Malware payload (CobaltStrike)", "value": "193a5e7835c8fa184738c4fb15414a25785c93fa", "object_relation": "sha1", "Tag": [ { "name": "213.227.154.6", "colour": "#296310", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362644, "uuid": "50cdfd83-a25e-44cd-b5d9-bc67da909e05", "comment": "Malware payload (CobaltStrike)", "value": "bf06bc69cdc65f2de83b7ce25350a99184ab36b0f7e6ac77e20d091e24d5dda5d45cea15fa24c153734cabfca23812c2", "object_relation": "sha3-384", "Tag": [ { "name": "213.227.154.6", "colour": "#296310", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362644, "uuid": "57e99538-c3cc-4de3-bf90-befbe96de315", "value": "F124F13DE7A735E9CCFDB438DC045AB93F63526B0A282D054D499AC49D921DAA340FC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362644, "uuid": "4b2950c6-62ed-4999-a3e0-1cf95403c2ca", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362644, "uuid": "b6af2bc8-bcf9-4391-a52c-c4a8aa4bc84a", "value": "3072:9aQH7mDCqVtO9Ek3DvHe2cnwIK2SKDgirhwx3wOgzTz2Vpp5ODHSlpaVfNVTZal:9FH7CuqiDvHqwIDDZhXOwWVpp5ODcoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617362644, "uuid": "f69e95b8-d559-4fd1-bb3b-e667e6e3f222", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617362644, "uuid": "128f5e91-287c-49d1-818e-50a81492a7d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362644, "uuid": "8c167be9-b6a2-4b9e-a1c1-dbd3ca5fd937", "value": "023cff6801f8909f19d3c66e3ad286f6bb84a6b4f518bfac3d44026318fa8775", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4232d55-93a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617364237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617364237, "uuid": "2125be68-4fbb-454c-8467-e440fad45173", "comment": "Malware payload (SnakeKeylogger)", "value": "2a62b974984fc2115b6677a1d71dc9d7", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617364237, "uuid": "ec3ef80e-2388-406f-b24e-6903926e39c6", "comment": "Malware payload (SnakeKeylogger)", "value": "039a4f52ea3ad3dfeacdf4b4fed070ed4e1e50430109b6f48aceb008ae1a2550", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617364237, "uuid": "694c6dc6-4c17-40c1-b06c-76c56574a314", "comment": "Malware payload (SnakeKeylogger)", "value": "1ec4cee38f2e8104faa741b0becdca248a5fa7af", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617364237, "uuid": "0155ebfb-79a3-4a46-aa9d-9c521acee6bb", "comment": "Malware payload (SnakeKeylogger)", "value": "9121968f79394eda4cca46874d0478cca79c9650274da4c669334967313f72b6b9e229f6c602a11982ced3da76151682", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617364237, "uuid": "ed3d548f-253d-4ae0-9e92-23d634f64aae", "value": "94259D293F64654CC0A7073A9858D01C9FEA7D59AAD3C1837EEE33DBA0B3F5306A4552", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617364237, "uuid": "8f189ee8-e517-434a-b80f-8ae70afd0fca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617364237, "uuid": "5b5c14d4-c6b8-4c58-bfe7-aae880407721", "value": "6144:D755dJvjbeiHHShC57u7Xd7A7ensy4Pob/RB6JE8LvGkUfnSuCXOpRl9+QH7UjfI:3bdJvvyogSss3eRXKCfSRAbHHkyZ1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617364237, "uuid": "ef64220d-dc68-41d5-a390-3962b32cb436", "value": 1034240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617364237, "uuid": "2a416c91-7e7f-4bb1-b933-38cf5a3a815a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617364237, "uuid": "1fa3e90d-dc5c-4793-93cf-3a4e140dcdb2", "value": "New Revised.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "011af799-9372-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617340341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617340341, "uuid": "6fe0e518-c803-472b-9a9a-fc2d4279e6ab", "comment": "Malware payload (Dridex)", "value": "2d0610faf710066b44e8dda4e03d697e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617340341, "uuid": "57a27529-4130-4293-9046-0290ded4dcd6", "comment": "Malware payload (Dridex)", "value": "0419fed54a15be74c434c7628980c69afe7185155d3b5e39aeac295213c5d835", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617340341, "uuid": "67df4d24-ef00-4b8a-b6af-ff84f4ef7120", "comment": "Malware payload (Dridex)", "value": "a2ac36d94f1fa8eb452da76a92c4daf4febaa6a7", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617340341, "uuid": "9acf276d-4a58-45c4-853f-382942e4efbf", "comment": "Malware payload (Dridex)", "value": "cbfea12ffd75db04d2280fcd4c9fe3a04d5628f00859f0dbabc884a14a1349e55268118a45227d8192c3ea517e3e6930", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617340341, "uuid": "b827feda-2f7c-4ce4-8cdb-b92869fa26a3", "value": "7114AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01E124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617340341, "uuid": "6b3c6c20-25bc-4809-8483-08fc38d7d472", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617340341, "uuid": "0d3c6cdc-de11-474a-969c-2889289c327e", "value": "3072:B1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:zi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617340341, "uuid": "9aa19f30-a657-4f67-8ca8-7775de1e83f0", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617340341, "uuid": "b844c14e-2d3e-4210-aa11-a6597c141ca9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617340341, "uuid": "498cd3cb-11f0-4db0-989f-24296bae806a", "value": "0419fed54a15be74c434c7628980c69afe7185155d3b5e39aeac295213c5d835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e349e499-9392-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617354465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354465, "uuid": "42b7e841-e0d0-441d-a029-2c4c3b3cf2f3", "comment": "Malware payload (AgentTesla)", "value": "18e1e45cbd1415d618b518e8ed2a9857", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354465, "uuid": "7c2807af-abdc-4e96-a666-86ce98140e96", "comment": "Malware payload (AgentTesla)", "value": "0494a953272a7203b705083ec85880b9460a8639e93071d713323facfdd24771", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354465, "uuid": "8a62c068-8e25-4190-87f0-a699e1b924d9", "comment": "Malware payload (AgentTesla)", "value": "e8b4158889e309bb5b7151111db4beac9f8b2149", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354465, "uuid": "02512c38-c313-4906-b566-b162eca8502d", "comment": "Malware payload (AgentTesla)", "value": "e460834bb3168dcaab76345ad8f8bfc49300c5d6092120bb23fca1ee278c2adbc08d3b2639785263331363a3e9a111ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354465, "uuid": "1e7822a1-c5e3-4ace-b595-84821b219edf", "value": "A1A423B34F7A0EBCC099DD5BCC40D95405CEB2A49098ED88FAA1B97F775C6C68C219B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354465, "uuid": "6e4f42e9-b34e-4558-8b8e-f89419128b23", "value": "12288:HlfYv9HI78Z01ZHi2Xwh2ypxDq3kOEmOeI8EGjjV:Fw1ktZwa3kJmJ5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617354465, "uuid": "603a3815-a39e-4246-a609-9066edb0e371", "value": 491847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617354465, "uuid": "42039b8e-de28-4931-9b7f-4d8fa603cad9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354465, "uuid": "5e3db368-c225-4549-8e70-472a0d340a87", "value": "PO.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35a21cd-93a4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617362115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362115, "uuid": "ea6efa73-2b8e-43b0-9ab8-76c75e00b7d7", "comment": "Malware payload (Dridex)", "value": "92fc270062461e1e02d1da582ad59ebb", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362115, "uuid": "ed1283d0-b3f0-4425-8d06-83631cf88817", "comment": "Malware payload (Dridex)", "value": "04f27a9998e9c1f3114732c149d10b3f6b926852044536f195bffb3b6ef57923", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362115, "uuid": "2da09ad1-5bc7-4d07-a157-243c5592d768", "comment": "Malware payload (Dridex)", "value": "9d9f871711582d07cdbd7f42f4b38f5bf34c5817", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362115, "uuid": "2f9f7a1e-6662-49cb-bde2-f36d53b4548d", "comment": "Malware payload (Dridex)", "value": "accb0245085095aea2d36ef6c2d5f8d40b8150b10756e7155f703db55f5a4d96c25c386d2641927d1e4260202d22dd97", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362115, "uuid": "c5f286b6-7e48-4773-90f1-a5cb987714a0", "value": "E414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362115, "uuid": "c160a67b-6f30-40b1-86ab-5dfce783272c", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362115, "uuid": "36c4dddf-41a3-4900-baf0-5de0d06e8fd6", "value": "3072:xopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:GpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617362115, "uuid": "cdcc9c24-39f4-4bc6-aa9c-d6d62f48dbba", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617362115, "uuid": "b52b81b9-560d-46e1-a307-55f13e380f38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362115, "uuid": "bf1dc691-fc56-4c8f-a76f-25309e2d8922", "value": "04f27a9998e9c1f3114732c149d10b3f6b926852044536f195bffb3b6ef57923", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a93f25f-93b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617370207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617370207, "uuid": "b223c732-62ad-4f26-9558-41c3d308dc35", "comment": "Malware payload (Dridex)", "value": "9d0a6b9f2bc52cee8563d36e7f80d379", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617370207, "uuid": "79bfc287-0f47-452c-8df6-4a01458b1fe8", "comment": "Malware payload (Dridex)", "value": "05251989ea7e82b74a74e5b47f437e7bee3b276e1f090423087b960bef9f4570", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617370207, "uuid": "bb231304-74ed-461e-990d-eaca55bb1596", "comment": "Malware payload (Dridex)", "value": "9672b1415af0b845f8a069b05f11d2a20174e92b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617370207, "uuid": "fb95761c-5b6c-43d6-a302-517b389123e3", "comment": "Malware payload (Dridex)", "value": "9f6eb02c5ab6635c381432ce75d2874fdaeab6fe4458e87b6a692c07fe984b4df91df677a8f4d7e059787c5bb28d9062", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617370207, "uuid": "90b40f57-4daa-4a9f-89a8-013b1c09629e", "value": "1614BE4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617370207, "uuid": "bd3187f3-f1e0-4e3d-814d-32b477b5a325", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617370207, "uuid": "ded26e80-31ca-457e-85a1-e437d2eb4a3e", "value": "3072:Aopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:npjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617370207, "uuid": "644612f7-5b63-4ef6-a979-55a83548ab2d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617370207, "uuid": "a892ff5b-db15-491e-847c-c98afccbf384", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617370207, "uuid": "61119d6a-af88-4f9b-b11f-45064bf2d99a", "value": "05251989ea7e82b74a74e5b47f437e7bee3b276e1f090423087b960bef9f4570", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a49a28-939a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617357935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357935, "uuid": "2a0f30ca-1b46-481e-bd65-e2140a0b7afb", "comment": "Malware payload (AgentTesla)", "value": "730203c0015445daa09d331f6fc1e5d9", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357935, "uuid": "b6bcc660-5b22-4aab-849f-48bb5e8f5c17", "comment": "Malware payload (AgentTesla)", "value": "0561e4b9f0bc91f719a3e92ac56709869ae76c3bb9c36e48f4a9c1df5be91ae6", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357935, "uuid": "91eefc44-7bf8-427b-8989-42dcad4751b7", "comment": "Malware payload (AgentTesla)", "value": "b78a09db9e830f8a5510ce1ca34392904cb7ff4b", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357935, "uuid": "a49d72ae-5463-455d-9f01-62bfb26109ee", "comment": "Malware payload (AgentTesla)", "value": "3a3a94efce5cda23c3a9258b4a152c26d3fe520c4a0df69824c221f60e31f0c57f93314fb860f3bdf8237a801b74a322", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357935, "uuid": "6af2097f-965c-4b67-9e0d-6e10075c4e5d", "value": "BCE4239E2CD38F6CCCB5169ABDBD42A327B625EA30B9D9A8D4C11804DC7F9A0C467135", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357935, "uuid": "f80cafc3-7331-49ad-bdd8-d9dcd81d1277", "value": "12288:VqTzwvKqZZKCLZzKQVUbVY/SXl0lZP23rVcJC5Zz1pgnIsebg/HZgoT2bDe7XBLI:ETz+KkmyUbVY/NGrO0g/HZgoTyDKyZTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617357935, "uuid": "7172a25d-eed5-427f-bba4-62f4941e0bc7", "value": 681064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617357935, "uuid": "a87d6646-ce3f-4502-908f-9140b78b5d7a", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357935, "uuid": "2decd5bc-3bc8-4399-8ed4-bcfb4bbabf4f", "value": "contact form.pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f461148-9395-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617355398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617355398, "uuid": "5a1c028b-272a-4d0a-80ec-bad59a5af209", "comment": "Malware payload (AgentTesla)", "value": "eecb61e8fec3dbd156eb7effa5e13287", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617355398, "uuid": "c1e14695-27d4-4ac8-a0e2-a090dfd0c2d1", "comment": "Malware payload (AgentTesla)", "value": "065ceb0fbdc5edcda6be175b0448361decc0f48a88dabdf39bcd31e2bbea9c29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617355398, "uuid": "5e8e2899-506e-492f-b67f-71cec8964d63", "comment": "Malware payload (AgentTesla)", "value": "ffb58ba953b7f1fbbf18c2ad8fd64c5bc991b6d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617355398, "uuid": "75b6834f-e52e-4d3c-ba0b-9c489d406384", "comment": "Malware payload (AgentTesla)", "value": "266e38d433cad2cecf8ff24797e124ba7443b7232e6c7940248e82b747320c577f7690f46a5d46e01137fd57325f27e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617355398, "uuid": "94d43ff4-cbac-49e2-8f14-7d2d0a0e7b07", "value": "EB45AE40A2A44650ED1E5779A53AC839C3B7BDE9A87BCB0C19DC3CAB3B773895C50163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617355398, "uuid": "c02fe1f4-c884-44a1-a433-88dfa5db5297", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617355398, "uuid": "4e47e975-44fa-46cf-878f-3b18a3f712a6", "value": "24576:LCSNS3eNC60VHunhDNOfwigMvMtzhF2LL5c3rN8j1q:/S3eNsVOnhMfwivMtVFgc3rN8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617355398, "uuid": "8232417e-f8a7-45a9-887c-c97c50c13c05", "value": 1178624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617355398, "uuid": "e22d07a1-9aab-4ed6-b3c6-a1d0b8c2c846", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617355398, "uuid": "6195ba26-2df5-4d64-9ac9-074809fd0e32", "value": "Quotation.pdf...exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f60df31-9392-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617354109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354109, "uuid": "6aaebb6d-6508-45ba-a278-7f4035c72a58", "comment": "Malware payload (AgentTesla)", "value": "242b70e0daf5d7043cc9525cd6dd206e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354109, "uuid": "213b1b3b-2765-4402-956f-2d85d0dcb260", "comment": "Malware payload (AgentTesla)", "value": "06a7a27bb885699c587413d9c640c761b27f6745a76902175cbd8a45420a4f21", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354109, "uuid": "c546fe0d-10f2-4268-a64c-55a07b7c80d2", "comment": "Malware payload (AgentTesla)", "value": "0b8aab42adfba56bde705b657a587774f35b1859", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354109, "uuid": "b313b1da-8124-4230-9ebb-47aa0678b095", "comment": "Malware payload (AgentTesla)", "value": "b45005eb1b7b9f65af41954a22d9d08132f0b526198ddaf0c98c9f895417da75895cc14ccdb912c289e6a76b7595149b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354109, "uuid": "5d11260d-2ace-4eab-9084-767cb76c11e6", "value": "8374235B6A2C0353B3425DC687C3F1BED6BD8E417455EB82E0D820977669EF38B40B64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354109, "uuid": "15a1ffa0-84a4-4358-90e9-1ed03b30c34c", "value": "6144:oD4m8mGXaWXrivTM7aZ/XJroWKmG1ImQACbZB90nk55bPwfqXz7kAsydaG:oEt8vBrdKm/ACF/0kvAqcpu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617354109, "uuid": "ad6b2738-f7cd-4502-828f-16127d38e1fe", "value": 345429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617354109, "uuid": "9ad8068a-a4fd-4ee2-b1f5-91ae669f7682", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354109, "uuid": "63d1e9cb-caa4-4b7a-bcea-4eac0cdf20fe", "value": "PO_287104.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d69e1242-9387-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617349719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617349719, "uuid": "8e811a87-41f4-4e78-aa22-78f8c18ceab9", "comment": "Malware payload (Dridex)", "value": "7c6ee04a5ce2ab47812dd04593f89529", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617349719, "uuid": "7ffa7ded-d677-490f-8c12-1fdf2c842cb7", "comment": "Malware payload (Dridex)", "value": "07d04b4c3ca17a70680a701f482ac20c43cba6b10d554a1db524b92832cb62ca", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617349719, "uuid": "f640ac36-4cd4-402f-b6ea-9ffe7f7b0fc1", "comment": "Malware payload (Dridex)", "value": "8fc164b43ecf14bd77e250c8376d5265d1b38347", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617349719, "uuid": "d3509b79-591e-4922-ac4b-dbc9ac52e987", "comment": "Malware payload (Dridex)", "value": "2a2016c00d52611deb1f200990a9934d1885103116b57f5cc47bf2a0f7303601e7cee0ad4ff9d5de31bf13ff0878f5f6", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617349719, "uuid": "ad85392a-b9b5-4d7e-96fe-370f448ec891", "value": "7614BE4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617349719, "uuid": "c6cd735e-18d3-49bf-b079-c30784046467", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617349719, "uuid": "628c5867-003b-4be4-b0ed-074f4b1f0946", "value": "3072:0opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:rpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617349719, "uuid": "f342b191-20f7-4bf6-af46-e2ec4b08e92d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617349719, "uuid": "e607bf95-d7dc-4b47-9558-71a8ec9e68e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617349719, "uuid": "93e6e4de-931d-4302-a3a5-db4c29a74150", "value": "07d04b4c3ca17a70680a701f482ac20c43cba6b10d554a1db524b92832cb62ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f51da2-9352-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617326747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617326747, "uuid": "04c2714f-0591-4606-824d-3696b8a52056", "comment": "Malware payload (Dridex)", "value": "89e30de7fc2e08e51d82f230ea3e4b63", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617326747, "uuid": "a38235f4-c002-4583-b554-47779342f83b", "comment": "Malware payload (Dridex)", "value": "0825bdb15a4bfb07eec5de19f99eb525db6f8754e4f696c20af59fbb2b9ef232", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617326747, "uuid": "51d7b819-6a91-411d-9821-7817c247bf3b", "comment": "Malware payload (Dridex)", "value": "232a4fe2f73f03fce9de8cf02f06119fcb5d6e02", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617326747, "uuid": "ba98ff99-d0fc-427c-8c7b-376532922dc4", "comment": "Malware payload (Dridex)", "value": "d45dd1f50dacfbfe11183540bee88bd5e57efe49276faf6bf3d94c6add5c54614708651d7d2fcec092bb7480424fc81b", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617326747, "uuid": "62d5c7ee-809a-42af-a211-d5eafc36c984", "value": "5D14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617326747, "uuid": "63d7fd2a-9c0c-45de-980f-93b7469b051f", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617326747, "uuid": "b61aa595-53db-4da4-88fd-eac77aec7d5c", "value": "3072:2opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:JpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617326747, "uuid": "f8335301-8607-4c58-890f-7ac8a3b484e1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617326747, "uuid": "85f3b0b6-6205-4d04-b5f0-c5b2192d98ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617326747, "uuid": "d950a158-f362-4e31-8060-41ae26435a2b", "value": "0825bdb15a4bfb07eec5de19f99eb525db6f8754e4f696c20af59fbb2b9ef232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c6b7d8-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617386549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386549, "uuid": "8bcfbe40-75b9-4ede-bff5-f2b891033a19", "comment": "Malware payload", "value": "f4787944e95596ad1847910ce4180a20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386549, "uuid": "01c1b5c1-a3ac-48d3-a322-8ab2ddc93f8f", "comment": "Malware payload", "value": "08acc4229c4d8424570ee93f20f7c60a0e9e0605f7dc8594d14d52209b72ce00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386549, "uuid": "545e6949-f55a-4ead-a5f6-984c3b592e6a", "comment": "Malware payload", "value": "f6ec2109ff3f3985ee6f73d0cf680343a90c8b2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386549, "uuid": "22f0928a-146d-4848-96ea-67ee533628d3", "comment": "Malware payload", "value": "a315ccae50e92b5225df22d57a318262c0512e095475e92221c19d0713900b635233854efec429a340e184bcd2610086", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386549, "uuid": "f3344d6c-cec2-4c6a-a6d5-6d6d8ceb4bbd", "value": "59257D123A44CDA2E0790636D9EF89144BFCFD513B62C75B7F9A329CA4513E24E1E1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386549, "uuid": "2f687da7-d8a1-42b2-b4df-fa5ece850910", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386549, "uuid": "6f69ed71-4d58-4243-8b3c-ce6f9f54ceb4", "value": "12288:aRZ+IoG/n9IQxW3OBsee2X+t4RbnKhWkcbVXyNd2wHfoS/N09OqnF:U2G/nvxW3Ww0tK8keXyNdr09O+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386549, "uuid": "91339c65-5102-4efc-915d-a3812ac4de7d", "value": 964740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386549, "uuid": "74cd4cef-3654-4c5b-9bd7-a9bee34ac94f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386549, "uuid": "6c31b3a6-0752-42ca-9002-e1003413bdd9", "value": "f4787944e95596ad1847910ce4180a20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f69ee7-9405-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617403836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617403836, "uuid": "549cf545-2c0f-4375-9234-306a197af7e6", "comment": "Malware payload (njrat)", "value": "a4bf5a5d8c2f3fe0aa055b8bf1f6ecab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617403836, "uuid": "8af7c034-d024-4087-9096-ecda46481418", "comment": "Malware payload (njrat)", "value": "0986ce159690c6411d191607700d668ba4bd9364320d5ef2e118eac83c700a00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617403836, "uuid": "fb4023c5-85b7-4a37-b1d5-0a658079f63f", "comment": "Malware payload (njrat)", "value": "f51c69f0c3ee1801bee6db8bcdf6468232453aa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617403836, "uuid": "8915cdea-964d-48e7-889b-6abd75028032", "comment": "Malware payload (njrat)", "value": "3920aad250d4c8af47cdbdeff13b315085e59bf999fac18fd2988df56a1a7a5c661167725709b8ce79e301bf31689848", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617403836, "uuid": "e524f326-9442-4ec5-bcaf-d615c3e43dd8", "value": "73F43FA96F4812B4E96633FFD493E23430D94C4A56C125069F773EB5393126BED8A0CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617403836, "uuid": "3386a830-f937-4fee-877e-580ad1006a7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617403836, "uuid": "3d758714-9295-46f1-8556-4f7158bbdd5e", "value": "3072:XpYP/lpZD4adhbUdeW6a0bzw6pEOhzVDZqaVZuWBGgXEVxbdK6wYkqfBn88qcf5A:YHxFHhpoavBGgXwxyYkG53behyvHLz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617403836, "uuid": "f58d53af-a4a0-4a87-8b2d-c0871e560669", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617403836, "uuid": "1b313a0b-8fac-4071-8af8-720d7abe1926", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617403836, "uuid": "c353cf28-29ff-4d3b-8eb6-b7492ec533ae", "value": "a4bf5a5d8c2f3fe0aa055b8bf1f6ecab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb17cb42-93b9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617371255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617371255, "uuid": "0647d0fe-cd11-491e-a654-3f27bb1de2b7", "comment": "Malware payload (Dridex)", "value": "0e0e0642a18c4b3079c590d5ade1fc9c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617371255, "uuid": "ed3c8549-e010-49aa-ab44-4b575aec39aa", "comment": "Malware payload (Dridex)", "value": "09c578963b516f56de8e3b9dddb2a1efab12cb1ad33162e31be3ddba2673f3d0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617371255, "uuid": "88a92add-128f-4bcf-bef9-fe08829eca02", "comment": "Malware payload (Dridex)", "value": "e944f41d059787df6ea2bb5f62d8fbe091890f24", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617371255, "uuid": "268425e0-23c1-4d6d-b6c0-d3f21051d0af", "comment": "Malware payload (Dridex)", "value": "ff0b9b09d3692cb1f7fcdedf8e5365f125875b82c60fdeb172083bb283d59145c05ef5dad523ce7c2cf344cb7022ae2e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617371255, "uuid": "1499f2f3-764d-4c18-be71-9383aab5ab8d", "value": "93248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617371255, "uuid": "bc45dbb7-fc05-4f7f-96e1-69934cc35af8", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617371255, "uuid": "bb087a24-46a2-45b0-af0f-45fb7509eb6c", "value": "3072:16TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:1oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617371255, "uuid": "7955a31a-a595-4f63-bc7c-12456e38d185", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617371255, "uuid": "f72cba57-efb0-481f-8c07-c12242277541", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617371255, "uuid": "73d3fdfe-523b-4185-aed6-5e44395cd5fc", "value": "09c578963b516f56de8e3b9dddb2a1efab12cb1ad33162e31be3ddba2673f3d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a83257-93c8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617377695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617377695, "uuid": "fdd1bf31-60f3-4dc6-a757-71b45505a8e5", "comment": "Malware payload (Dridex)", "value": "7a50006b5d1a778b9600fcb2c63a6a7a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617377695, "uuid": "f3e82533-a7d7-46ca-8fb2-5f8472422e45", "comment": "Malware payload (Dridex)", "value": "0a09d49e1a47b9af64e0086b3fc976045723ff56e655ecda6b322e452c88c294", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617377695, "uuid": "bc442dd3-5094-4972-9e49-8cbbc67b1155", "comment": "Malware payload (Dridex)", "value": "f2463f474578dce134a2e1a443100a93e727c005", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617377695, "uuid": "9b265306-2cfd-47f4-9d3f-94f96183b00a", "comment": "Malware payload (Dridex)", "value": "a01ee0a1fe8cd1e8fe0dd0d2531a356ef01de6ad470fd5a95d60094dca7583dd66fc156912c5f57b1f18c61fa2bb2160", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617377695, "uuid": "2378c01a-999e-4bd2-957f-86e2eca9d6e2", "value": "BA14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617377695, "uuid": "e99b8f4e-de60-4970-bb36-603a5ee8b2f4", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617377695, "uuid": "c55101cc-b751-4a3e-9194-a6279fa79952", "value": "3072:N1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:fi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617377695, "uuid": "227859ae-cff4-4760-bdbe-a54db7a01ef6", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617377695, "uuid": "81926522-1e39-4980-a174-fb46c39b8cad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617377695, "uuid": "4112045d-e457-49b9-9a82-5c686634b50d", "value": "0a09d49e1a47b9af64e0086b3fc976045723ff56e655ecda6b322e452c88c294", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b29eb22-937c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617344814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617344814, "uuid": "b14f6ae7-a8e4-495e-a205-68882af045cb", "comment": "Malware payload (AgentTesla)", "value": "c3d06cbf8c237b569c0f1b33686e2a30", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617344814, "uuid": "581225e5-8f01-46df-9221-3fcfa8befd81", "comment": "Malware payload (AgentTesla)", "value": "0a163b497b34fa65684b1f5f89a339f0dcfc24699b597d61db7f7dc46a11aad9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617344814, "uuid": "2b505d07-403b-494b-8a99-805f5f65949c", "comment": "Malware payload (AgentTesla)", "value": "7bf3dafb165646da2f02885885c413071f67509b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617344814, "uuid": "d01b3163-2434-4ad6-9f47-b00f4cd7fe3c", "comment": "Malware payload (AgentTesla)", "value": "10814737ebb2874a89c813bfab656607dc0c6da133cbc608d3f7ca2d09d63a4695f30933978aacee097c38e55528d06c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617344814, "uuid": "cc1ab97c-516b-473d-91db-2c707a6fa9d7", "value": "6CB423FA9D1FD3C354D77B8750602EB1EB38A3955129BA614F81476B089322B8F72BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617344814, "uuid": "edb7cc33-dff3-4a48-961d-1f085b0118fd", "value": "12288:Ny2oZYnk/uDHzlqCtr9rU2gf4HaTOujv4xBAG2RgYxfw2f4A1:SYk/uDHn9rpgTjeLMxfw2wA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617344814, "uuid": "fef09dbc-f0a8-4407-a0c9-4a0f034750b2", "value": 498206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617344814, "uuid": "3915e7ec-9fc5-4c3a-b067-95d5e5423059", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617344814, "uuid": "e7d81f97-a405-4575-bb02-b191351546e5", "value": "PURCHASE LIST.pdf.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5c9eba-93b4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617368818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368818, "uuid": "fc63405d-601a-4f6d-93ce-0364f5906392", "comment": "Malware payload", "value": "9fe2c1fb7d96f77d67a09f3870ede636", "object_relation": "md5", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368818, "uuid": "41def8f2-0d77-4c40-ab6a-e4b7d86df4e6", "comment": "Malware payload", "value": "0ab12e6098899e43f0cd23c08a995d1dd7522f47e58c18bcd80aebbcfcea5680", "object_relation": "sha256", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368818, "uuid": "f835f083-1b86-4d79-a459-3a5a02dbeb76", "comment": "Malware payload", "value": "826c4367159521fd2ec04a825904f5e6f2bcb3fd", "object_relation": "sha1", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368818, "uuid": "7552873b-0321-4efd-9fcf-84d07c2775f0", "comment": "Malware payload", "value": "cb231ae942416a812fa94954528af3923124eb3a78eb9cf87c6f0ae9ff4886f6371baddace1c6fc8a27d03a0455093cd", "object_relation": "sha3-384", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368818, "uuid": "9b6cdf22-b73d-4c41-a78f-91c49570b256", "value": "51F44B223A48DD01E1AE2237D9EF45185BFCEE41B667C71A7E9B336CA4513A36D0D0C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368818, "uuid": "45921036-7040-49e4-98e4-c937b2024d31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368818, "uuid": "73a37b50-4c09-4210-80c7-e2319290269c", "value": "12288:hH9WoCy8G6wkuotc0p5z7DlYIS34+innSFXXtx+3atFWKq5qn:hH9Wo/1kbtcglY1zinSFXXtk37Z+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617368818, "uuid": "ddc1bbce-1344-44a5-8847-9f6e88d4bcc0", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617368818, "uuid": "8b3bc2f5-17d4-421a-a515-e06fc52b1545", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368818, "uuid": "72cd1623-9751-473d-9e89-9bd147ece4a8", "value": "RuntimenetcommonReviewsaves.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51384169-934b-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617323725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617323725, "uuid": "d40619c6-28d8-48c9-bf10-c30b46c1d544", "comment": "Malware payload (IcedID)", "value": "0b00d514b6484a16d706d6098c336b44", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617323725, "uuid": "65926418-892c-4cc7-b10e-2e37076591ff", "comment": "Malware payload (IcedID)", "value": "0bfbe59ac91d909de8ef5d3899409bf34dc7636972a6e65154cab44c85a8adee", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617323725, "uuid": "572132c6-543f-4d84-b531-5e31e383d1e7", "comment": "Malware payload (IcedID)", "value": "8e6b942430896c760eb54f87c8395b02284a4e24", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617323725, "uuid": "b9c270f1-a16b-4f48-a45a-4ad8ab9fccea", "comment": "Malware payload (IcedID)", "value": "857fe891f561283ed7b62b53b908f091f3f1c7b32e93a5066155ae8ed1b7c394dffe2d4072783ca969c5e936b4afb44c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617323725, "uuid": "0e5fdea3-fa24-47ad-9bdb-55bc45083a8b", "value": "F314F7935CCFB663D42F90F1A8A1547D7F30BCC413E297DBA9084B1AD993792A972318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617323725, "uuid": "c73d0ef4-496a-4120-a31d-09c07ee2e32c", "value": "3eb5471c5370e4bcb3be6637e4995a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617323725, "uuid": "343a887f-e49a-4b36-9729-8bc100d18c01", "value": "1536:Vq8ByBeZnwLGM+NoV1XjeNSaziIz7Ja5j/Nj/IXoZcq+M6qaCZZtr2wS+FJZLT:Q8+Kjv4RECZnrDSGZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617323725, "uuid": "c0cfe125-226b-4e9d-a567-2a2656b007d7", "value": 203808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617323725, "uuid": "2be5d41d-6729-47bd-b106-dbd59a4b47b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617323725, "uuid": "61dab5b5-d6b3-49e6-9daa-71e318d2889a", "value": "0bfbe59ac91d909de8ef5d3899409bf34dc7636972a6e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc8f76d-93aa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617364659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617364659, "uuid": "1421dbf1-bfdb-495e-b2f5-14dbcae91ce1", "comment": "Malware payload (Loki)", "value": "3ea576de0f141da0cf13a2420b8efe8e", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617364659, "uuid": "c28276fd-f4c2-43b8-a052-238d2aecc7e4", "comment": "Malware payload (Loki)", "value": "0c20e66bcbb28f8bb3d4e74edc7556309550858d45ccf83dd6a846f43f2a68ef", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617364659, "uuid": "bb80fa1e-60cf-4fe8-86f2-3b71024241c2", "comment": "Malware payload (Loki)", "value": "961b298e9dda7c4e2a0d99755ed8e837d3eac8be", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617364659, "uuid": "cad146a3-4277-475c-b0f8-68b762aa2de3", "comment": "Malware payload (Loki)", "value": "062459c3b336ccdeec464629aa4c657959c09058c3d202628aaf9901a038c8a7751f8623101b94c0faabd44ef4f2c860", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617364659, "uuid": "4b3f3d98-893f-4b68-8b94-5d88d62d74ea", "value": "7994234F213384D462FE5EDF1DEFC41BC09BF5A212774CA8E5ECA248C0AD5D8A66D1A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617364659, "uuid": "0e9a7237-a0c2-449e-a9e7-226f5e3a9326", "value": "6144:Eu5SyuXKQZ9DDf74fiMDKV8SKFaCNNXd/a8er7qwjizktD0oYC9gKIq/:xrGZFAfiMeV8SKkCAn7LjizuNYmn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617364659, "uuid": "b0e2076a-9c3d-413b-87a4-cbb50f587550", "value": 420661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617364659, "uuid": "38465103-a153-4bbf-bee6-422658ba5076", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617364659, "uuid": "2413c2e9-3f7f-4882-a924-595f63fe5bea", "value": "New Order.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a712eb95-9365-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617335036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617335036, "uuid": "9296170b-5253-4f22-afe5-d081d43c0e6c", "comment": "Malware payload (Dridex)", "value": "aaaca7e0a83a3b3a05484393fb2a302f", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617335036, "uuid": "b28e63b2-15c3-4496-bb33-6d2d97b9d659", "comment": "Malware payload (Dridex)", "value": "0c3c84e1df11b20037d045f19eb50aefa287ef49e45dd0735b8701406793cbac", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617335036, "uuid": "d8e22003-d02f-4a0d-863c-21257698d6cc", "comment": "Malware payload (Dridex)", "value": "c3f2252b36ae5a1b1e8588857a492944083db296", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617335036, "uuid": "f617d124-7d18-48c8-a98d-0434261339ff", "comment": "Malware payload (Dridex)", "value": "c24af4c01d4274cfae92f13b3453fb498032d77853270e213fb55bc06a35a0434cdfbe24ad6a20fdffaf686d3163595f", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617335036, "uuid": "e19272c1-9612-4db6-b631-836e19469977", "value": "1114BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617335036, "uuid": "859c1b8f-9422-4aa8-b41b-f8062ecd73ae", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617335036, "uuid": "4307a4d4-3e0d-4f1d-88a8-1190a770bfef", "value": "3072:eopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:BpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617335036, "uuid": "b7b0e4e1-a86b-4119-b2ca-139d63ad1b96", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617335036, "uuid": "7345c58c-fd40-40bb-a18e-7ef3c85442dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617335036, "uuid": "41517eae-47c9-46a5-82a0-974ef8b8ce72", "value": "0c3c84e1df11b20037d045f19eb50aefa287ef49e45dd0735b8701406793cbac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e1e974-93b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617370030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617370030, "uuid": "261bb809-008d-4ce5-b839-ce3b14d96f7c", "comment": "Malware payload (AgentTesla)", "value": "a320665e9e17c884624a611c059a7206", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617370030, "uuid": "940580b1-1e0a-49a7-a0de-d9c17c8be1c8", "comment": "Malware payload (AgentTesla)", "value": "0ca3ec5f1edbbc99fee08a02b5e9acca760bde186e5f3e2775bdbe889419b1bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617370030, "uuid": "13829510-5db2-4967-b8b3-7d7a71413c3e", "comment": "Malware payload (AgentTesla)", "value": "2cac3ac9b242631dde60d35aefc0a3b8027d0700", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617370030, "uuid": "4584df8b-4684-4480-b676-2a2d5413e55c", "comment": "Malware payload (AgentTesla)", "value": "ffe6dae0009765e330adca234a7ed5e0b53dcacbc9dd8204f2fb899d6fef9678d85130ddd78b58ef03891b21af870f5c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617370030, "uuid": "5bd06bc2-beed-471b-a2d7-a30d081ca48d", "value": "16A423C043F8821C87866815DF6E95F2C815E575F82918357A3B28D4C2BC389EADE17F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617370030, "uuid": "c409b3fd-d2ed-4018-a8d5-b05d6a456dd4", "value": "12288:htRucgAHctTkQ/AO3/2XrgeZpLTW5B0acBpVT4rtn/u:JucjIkQoO3uX0qLT8mbBrE/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617370030, "uuid": "04b7379a-3f7b-46e4-a0a3-2f58859d40a8", "value": 474189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617370030, "uuid": "19a42ee2-5369-4aec-955a-1516dc301aed", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617370030, "uuid": "ca568d3f-b0cc-44fd-afd1-71f5e5225ce6", "value": "Swift Copy#947026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c000b700-9396-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1617356124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356124, "uuid": "f2132414-0775-4e7e-8934-f4ca56330485", "comment": "Malware payload (Smoke Loader)", "value": "e564ffc635a7c73751b8eaf78fda310b", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356124, "uuid": "50bae7d9-0f7b-47d3-8049-0a1617415fad", "comment": "Malware payload (Smoke Loader)", "value": "0f32500a74e76831740141dfc69676b97a72f9f66da30dfa3aa8648b836373cf", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356124, "uuid": "1b5cee73-fd13-4c61-8734-b6743457a66a", "comment": "Malware payload (Smoke Loader)", "value": "9da683f27d5abc76be2ea9fc2d09f9e230c86287", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356124, "uuid": "d1325bf1-b39d-442a-99a2-1207ffeb42fc", "comment": "Malware payload (Smoke Loader)", "value": "ce049ad5067f2b3b57bcedb1c4344048939f1de5ed6da910d43a83b6fa1a488830accc79b19168e3f801b1828b0a64ad", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356124, "uuid": "86d3cb9c-1b88-463a-a588-cbb6fe13c821", "value": "FA04AE00B5D1C473E2561A75082AD2A54A36FCB55F3466CB7BC43B7E9F362D28A36383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356124, "uuid": "7f0ee76b-7af2-4509-a453-8ba5344b7810", "value": "f56a6105556266f0c20c4a2c41a935f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356124, "uuid": "0530ab2d-cf5c-4ba0-8bdd-66f659fcfb63", "value": "3072:pwbbbSyMqDb04TG7l1Y+DsndJK52SCdrMUxJb7/:pMSDAglK+DskhCd3/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617356124, "uuid": "7546f196-94ef-42e6-b2ce-2a68c6401ce0", "value": 179712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617356124, "uuid": "30866405-97db-49f9-a6cf-27db30822924", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356124, "uuid": "4898157f-952a-466d-b942-4fa442e2f039", "value": "e564ffc635a7c73751b8eaf78fda310b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3785725-939c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617358760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358760, "uuid": "447ad04f-41c5-415f-973d-2fa19f9336d3", "comment": "Malware payload (AgentTesla)", "value": "b776d2b3ea9d630c4e363ac38cfb389a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358760, "uuid": "9b4f2bef-063c-4b07-89cd-b59424267171", "comment": "Malware payload (AgentTesla)", "value": "0f3a690019daca9599982c9388e1ae3c3eadb3b3a43730a23a956f36f7c8e810", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358760, "uuid": "a8e47dae-1f8b-4011-9d4d-01c62b996cfc", "comment": "Malware payload (AgentTesla)", "value": "481ab6c130ba2a3a800c050638eded60b478534a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358760, "uuid": "3613a10e-2e84-45af-8c1f-f7246233756b", "comment": "Malware payload (AgentTesla)", "value": "de35f40245e9e371f0132ef6bcc4966c95a772929b646ef643d848610cdfd12ff11a273f9ac7ebc0c0614ed758a8c7ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358760, "uuid": "ed4fa611-4987-4d77-b650-08f15bda87ee", "value": "89C4DF18D39C8B5EE17E57FB907072343FF9A5819726FF89EEE100AD1922681C512B1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358760, "uuid": "63c948ce-c8b7-41e2-b31d-c4ad59c75a8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358760, "uuid": "4a17ba4e-eb97-4a7b-b667-edbee91f8cc9", "value": "12288:Zr8YPaATadyrscZUqdQLDfQQJVNTfSt4Ii0:ZASoy4EcPjNTfSnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617358760, "uuid": "fac4cbf6-21d1-415a-95bf-fc4b0ef8d8ee", "value": 590336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617358760, "uuid": "27bc5825-7083-4e79-8673-b63b423d1c37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358760, "uuid": "42bd9083-212e-427c-b5f6-8b4acf2eed55", "value": "proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc74da3c-93f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617396088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617396088, "uuid": "4a1a5447-64f2-4efc-b371-0059f23934b8", "comment": "Malware payload (Dridex)", "value": "78ec0ece45bd71606968a5ada8848227", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617396088, "uuid": "e90c8246-534b-44f2-aaa7-a779a9e948d2", "comment": "Malware payload (Dridex)", "value": "0fb38b822b5b954386505d77afa2e68560fb29a9ddbb0febe9476f6c8ce6a7bb", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617396088, "uuid": "36b77821-cc6f-42f2-8774-8a88c9f216a9", "comment": "Malware payload (Dridex)", "value": "2f362a8589d8e2c54b9bb2198e4d3b872f5d922e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617396088, "uuid": "bfe71f0d-6b19-4cfe-b41a-8bc167a6f0dc", "comment": "Malware payload (Dridex)", "value": "9742a1087523990cc08cdf6e7775d429c4118400ecbffbd73a798de6c67aeb880b074b0833337ded897faac5866f5bd4", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617396088, "uuid": "17ae2bff-0196-4923-ad1f-48c2d622b3d1", "value": "F114AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617396088, "uuid": "aa0288cb-a9f5-49b3-83e5-e9be0766d9d0", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617396088, "uuid": "a62d6e13-1213-41fd-91a1-579b1e218f60", "value": "3072:w1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:si78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617396088, "uuid": "0240273c-3205-4f68-9463-c0d068934adb", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617396088, "uuid": "5666198d-2182-4988-a9dd-5ff887cfa31b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617396088, "uuid": "6010441c-2c4d-4997-9ae6-3875dd076ba9", "value": "0fb38b822b5b954386505d77afa2e68560fb29a9ddbb0febe9476f6c8ce6a7bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eed0d05-934b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617323775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617323775, "uuid": "8fa79501-1329-4f95-9e1e-ad39b27a9b65", "comment": "Malware payload (Dridex)", "value": "5fac091230d4ade8d172a351c8188d9a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617323775, "uuid": "37ff222b-3e9e-420d-b7f6-30d2ba987aa9", "comment": "Malware payload (Dridex)", "value": "10c1cac574bd0b11ee6f1150ce49a5066b60d8cbe11c506b9c7fedfec796bf24", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617323775, "uuid": "efad19c3-9ab6-45db-96da-eaf56052dffb", "comment": "Malware payload (Dridex)", "value": "a95d88aec233f3cf053ddf37a2bd7f9a40d72347", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617323775, "uuid": "d893f0f9-e87f-41ef-8d6f-9fe8e788e01e", "comment": "Malware payload (Dridex)", "value": "bc477e3b583cb61c519b14dd68fc16524573a91f0cec5f61b9d2ef9c414be51374c5c8b4e79d0cf3db8e9c3f0c231b37", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617323775, "uuid": "e138989e-cd3c-493b-9b77-b3d5d8a37cdd", "value": "E6248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617323775, "uuid": "403fd692-e752-48eb-b62d-58950d89e824", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617323775, "uuid": "a34708e5-743a-411f-b732-065d39271a24", "value": "3072:86TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:8oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617323775, "uuid": "f5cd6a49-1761-4ffd-a4a9-fe290c880d2c", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617323775, "uuid": "8379011a-81a2-443e-a491-4581f45f6c63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617323775, "uuid": "fadf9765-755a-459d-8b1a-0620f6123b6d", "value": "10c1cac574bd0b11ee6f1150ce49a5066b60d8cbe11c506b9c7fedfec796bf24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a1f6054-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617386527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386527, "uuid": "383b84c0-2bc1-4a65-bd56-b85849f4a2da", "comment": "Malware payload (AgentTesla)", "value": "3debc98e46ae846e4bbef32f088f0ea1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386527, "uuid": "abde5b9f-e4e4-461d-99b6-85a8d1f99536", "comment": "Malware payload (AgentTesla)", "value": "1109e9c4a8dceb63160c59807b81adc6d4e82c28529c80bd1ff80993dc906508", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386527, "uuid": "de84b50b-4590-412d-a342-5b5034f519f9", "comment": "Malware payload (AgentTesla)", "value": "b23f252d1adda453c2ac186ff1acad86dd0aeb67", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386527, "uuid": "d68e3a16-9eab-40fa-b06f-0e3b76ccd23b", "comment": "Malware payload (AgentTesla)", "value": "223f98c3ef9a1fd902df6880fff23f24b96e5c839bd450befc5f629af806a2704fcfba3f1f736578359d81614f21f168", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386527, "uuid": "ca9f7ed7-8fa0-4d74-913d-37b46d18dec2", "value": "8E15CF1023F48654E66F07BAD5BAC01DD3FAF1D5746BCF4D896860DE2D2274CAC81AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386527, "uuid": "ca351104-bab4-453e-a444-a31adde398c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386527, "uuid": "e827a78a-d5a8-42aa-9c2f-37877d312e08", "value": "12288:yDCSfVr+EuQeNR6MjhfHG8yPuipMogXZ5rG6UTX5zdihwPor+3DBu:kCSJ+8eNR6QNGDuNRrGNNz0isp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386527, "uuid": "dc80ff4f-9835-49cd-a0a5-30485b3ceffb", "value": 945664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386527, "uuid": "912c91d0-2fb9-4a1e-82c2-1967162543fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386527, "uuid": "54d32872-5972-41e1-a6db-a62495548f9a", "value": "DHL_DELIVERY_CONFIRMATION_CBJ002042021068506.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f198c99-9381-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617346807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346807, "uuid": "052d9bc5-d136-4594-88e4-8951907bfdc1", "comment": "Malware payload (njrat)", "value": "20ec57c0cbb930553bb5c475bdbfc06f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346807, "uuid": "a6cc4d64-c8a4-42a6-a4d6-ab6685446b50", "comment": "Malware payload (njrat)", "value": "11a7a7680b19929f2c608b02c89a6dca5397f5af559b3fb7d111f57da70299ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346807, "uuid": "dc0963cf-decb-47c3-8f87-e0978ae40289", "comment": "Malware payload (njrat)", "value": "29e4d3e01ce116920de02bb9c90fbb001b2cf242", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346807, "uuid": "216c91ea-ccfe-44f3-b3ee-729101469021", "comment": "Malware payload (njrat)", "value": "58b5e0afd103a09787746f0c907afb07fead56150bacc663ef22c6649523ada34bae251e23881b978737a4dda5ab5a5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346807, "uuid": "504746a8-5fea-4681-b609-f44826843691", "value": "25B21A4F3FA98866D5BC177486A5965003B0A1870423EE2FCCC554CBAFB36D92D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346807, "uuid": "24c7ab90-0420-4489-913d-61495b99f3de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346807, "uuid": "ca9a2aba-540e-4982-8343-8c3ccecdba66", "value": "384:OcqbCK0l4h7o9SVyDGvENuh46/gJkOmMSW38mRvR6JZlbw8hqIusZzZkN:B30py6vhxaRpcnuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617346807, "uuid": "84d440b5-7ef1-45ba-b7aa-d35da0b0f245", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617346807, "uuid": "09b986a3-4a30-4729-b3e6-d6572b562ad3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346807, "uuid": "023a28ec-ebbe-4758-901e-8641a6c3a607", "value": "20EC57C0CBB930553BB5C475BDBFC06F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3511c5-93b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617368544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368544, "uuid": "45c2f6a1-ca29-4f3e-a27f-fca1e9fa7767", "comment": "Malware payload (SnakeKeylogger)", "value": "167caa7f9f7aadc6c4d08a8b1f629211", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368544, "uuid": "5da4e4ef-e746-4815-9bc4-6c3c296add22", "comment": "Malware payload (SnakeKeylogger)", "value": "12d6803dee78a9de86c4a38ca72a11e053331d8efab68e3b611c699f85b31e98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368544, "uuid": "66c92422-0757-47b3-a429-d04beebea57a", "comment": "Malware payload (SnakeKeylogger)", "value": "c2d80269e5b62fdd79720005acc1d12f5e28967c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368544, "uuid": "9f3653ea-7bc6-42d4-992d-a59e95a193b1", "comment": "Malware payload (SnakeKeylogger)", "value": "ac7d5ab879cf801bf5945b2fefa2b9da59129c46f624c275c61a3311eb831e0ad79038b0c439982e6439d68c006b6320", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368544, "uuid": "4f10fa80-94ae-4c39-864a-e35fff110292", "value": "6215CF1023F48A55E62F47BAE5BAC01DC3FAF1E1746BCF4D8D6960DD292270C9D846A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368544, "uuid": "690cac2b-ae72-4dcc-b3bc-5afac7a3850b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368544, "uuid": "59e931a4-1c3c-4c1e-ab48-e4319ff79b62", "value": "24576:+CSrhezeNM6FoCjLKRgmPJzq0ZxvDVnA9:sezeNPoqLCpPpHZxBA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617368544, "uuid": "0cf047bf-fe3e-4d20-abba-f71f23fbb31f", "value": 935424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617368544, "uuid": "46488288-b8e9-4e43-9041-6ebef24df1de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368544, "uuid": "aa8e96c0-28a4-42f0-a3bd-88670e52e39a", "value": "Statement For Month..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04cdf201-9365-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617334764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617334764, "uuid": "536a6621-7a66-4b05-b9b8-0cc868f98ef2", "comment": "Malware payload (Dridex)", "value": "78f10b1dfc0971e72780a4adbb46035d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617334764, "uuid": "25e1ed6c-0e83-46aa-90ee-e77f038953c8", "comment": "Malware payload (Dridex)", "value": "145b1b4692fe7865b4ff5f7a69a2f7d32b03f8a097c53cda8e2e5a2230dd3b76", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617334764, "uuid": "35641b71-96f8-4a29-bf6c-1fba9c574bdc", "comment": "Malware payload (Dridex)", "value": "441b7465f325d2b3033828366046da12a55de48b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617334764, "uuid": "a07107b4-fdd7-41a9-b395-7e7e12bc5165", "comment": "Malware payload (Dridex)", "value": "11f19d3904a7feb7bed0a3c25127883b1cf9e7195c3919806d0684fd02f62dc0dafe559362e7d95a610295143f986f1e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617334764, "uuid": "16bc0579-a896-487c-bc29-93ac154b0669", "value": "D9248C5FE339E486FEE3CAF44186A72296A39C92476F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617334764, "uuid": "90779c87-7d78-4109-9e98-66f9564530ac", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617334764, "uuid": "54f1f68f-a566-43aa-8f66-e2179aa3ae2b", "value": "3072:G6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:GoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617334764, "uuid": "ee41a4ff-cfdd-4d50-8be6-c094c2475cdf", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617334764, "uuid": "fbbb620f-03ed-4b1f-af3f-9ef5a90d971b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617334764, "uuid": "45b12e5c-1496-4739-b819-22381252fff1", "value": "145b1b4692fe7865b4ff5f7a69a2f7d32b03f8a097c53cda8e2e5a2230dd3b76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7928b55-9380-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617346741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346741, "uuid": "8182ee6f-64f4-4885-8b38-0e0017f594c8", "comment": "Malware payload (Gozi)", "value": "0f8dcd896fde1b2e087c887e2c639165", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346741, "uuid": "20375487-c9cf-45e8-b82e-df206a56b1b9", "comment": "Malware payload (Gozi)", "value": "15d737e715abb9947ccd9cfff25d5795fa583c97f573730fe350c62f2ee8bac8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346741, "uuid": "983fc7ac-ca18-4f09-8d60-5a9b671d2ca3", "comment": "Malware payload (Gozi)", "value": "562e975b3840cc9133e7ef8dca3bbb8a13dce9d2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346741, "uuid": "90d8531d-3b84-4105-8cec-446a5838fa88", "comment": "Malware payload (Gozi)", "value": "e19d02d0b232a3ca898e1506e93bb1c592fd3eba2404a402ccebfe40e09b5c1e27c4874abc1e250f4a7479f2d93599a0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346741, "uuid": "89c9bf92-1d36-4b37-996b-22f0a2a05dd5", "value": "3183F113CE55D742E565A2BA7C8B2EE8BF02381C99E730CF0944078B7E647764B0E5AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346741, "uuid": "cb74a5f0-f825-4932-ac56-e3f2c6e24c0d", "value": "1536:u/QJfK+pPkrADhzpyY9ZXlk8qtZ0xaPgoy8+JmipkmvvtQSFBR0PfyI9LMRfWBmp:u/QJfK+p+ADtZ1k8g05oyDJmipk4vyk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617346741, "uuid": "491c6bdf-cea0-4857-bfbd-c48cf00e9061", "value": 81938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617346741, "uuid": "bb4a91a2-306f-4777-95af-7d863e784bea", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346741, "uuid": "f4e94f9e-efad-4602-b671-b27df76c655e", "value": "prescrivere -04.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1410c608-939b-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617357983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357983, "uuid": "acd5c75a-0ff2-4d67-9c77-de60376f9875", "comment": "Malware payload (IcedID)", "value": "e76db0743b161045a90579f1d9368972", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357983, "uuid": "70427254-f1de-4da5-9d62-8eed89938a4a", "comment": "Malware payload (IcedID)", "value": "15ea954969e6357ab168b7b913b261585cb1a6a361fe17c9b4fae98bff5d5fc8", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357983, "uuid": "2861a502-9991-407c-933c-616d96c0ded0", "comment": "Malware payload (IcedID)", "value": "feb02dcacf5604c887bfac2caff9535f5199e010", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357983, "uuid": "e6c57411-a5b8-481b-ac62-d0e6619a030a", "comment": "Malware payload (IcedID)", "value": "eb750be1c3a0c7d58535fd242fb93af97b739675d652e7e9b73930b4a0cbf4ce35ae0491125325fd626146f156796543", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357983, "uuid": "1cf2b0e4-6cab-4720-a00f-e3b4225ee001", "value": "54939DEDE907F4D2CA158F7C4D12758920BAC4A6265FF007709A622F5D22F6C095F2AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357983, "uuid": "dbd9fcac-a7fb-4552-8f95-6459027fab28", "value": "1536:YB2xe0FM42S2hawdIVseTSV7SaTe8NDUYl+LrHtlmuzx2ofDg:O2bMcMpnSaTDDFysE2obg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617357983, "uuid": "8081f2c5-14a7-479d-896a-749add348689", "value": 94801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617357983, "uuid": "feaeedf9-b7b9-4187-84e2-b544c869df0b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357983, "uuid": "6da2b404-b3c7-4fa8-9b41-aa55a629c0aa", "value": "documents-262276649.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e028101b-93ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617378511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617378511, "uuid": "3b13d378-b08b-43e7-b303-45eb0c96b4aa", "comment": "Malware payload (Dridex)", "value": "ac6abaf4fb8e845fae41735126c4458f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617378511, "uuid": "698b398d-2958-4233-892d-5499f6755980", "comment": "Malware payload (Dridex)", "value": "162c57283ea2c1ecaa48763c6728f5d6368e7413a3552419579796ac51228611", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617378511, "uuid": "b1318786-0c2a-4a9e-aaa2-d20d0a3f19f2", "comment": "Malware payload (Dridex)", "value": "9ab16e19963c82ddc0e63a9517d0797007c09c15", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617378511, "uuid": "dbd6e17f-4012-4430-881a-854503d8e9e3", "comment": "Malware payload (Dridex)", "value": "e97529925e0c6a982ba470ac232eba1b4de15a7619b8b387fabd752cbc81a00271b4e65bc1b84ec77cc2d5b7773d8cb6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617378511, "uuid": "ead198bc-1951-4016-be92-5b970e0bf87f", "value": "05248C5FE339E486FEE3CAF54186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617378511, "uuid": "0600d255-9a49-40c0-8292-e12a4ea0d5a0", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617378511, "uuid": "72941f99-a55e-45e4-959f-d75b58d3ee99", "value": "3072:b6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:boMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617378511, "uuid": "00309f8d-1492-430a-a473-6c444cb62074", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617378511, "uuid": "80a1054c-82dc-4140-b2b4-36644f06e3ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617378511, "uuid": "87cf51ff-eaee-424b-ac4f-4c995fc44258", "value": "162c57283ea2c1ecaa48763c6728f5d6368e7413a3552419579796ac51228611", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b4a74d-93ff-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617401291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617401291, "uuid": "93e443f9-b073-4f42-8c27-ded53b182683", "comment": "Malware payload (Dridex)", "value": "f56b56cc16fba782d838a6d20beda1c4", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617401291, "uuid": "857c9f00-120f-4556-b9d2-5d46c3f4db68", "comment": "Malware payload (Dridex)", "value": "178969333087c7d46ad09f7c758244c97b328b38941ac9d81d74f89540dd90c9", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617401291, "uuid": "586999fa-2741-478d-8463-eb1ad13896d7", "comment": "Malware payload (Dridex)", "value": "43a0810f6820820293d452efd76e8540ca40c7ce", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617401291, "uuid": "ca7ec4ba-424e-4fb5-86c7-f754e63b4a2e", "comment": "Malware payload (Dridex)", "value": "23516eb237fa366bb1c007b68644353ec7dd52eeac806db2d122fc1bc228dd16fdf742f89c9ea23397dfd52ec41ce43a", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617401291, "uuid": "9a3b717f-8357-4d8c-95d7-c7d63e666751", "value": "3814BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617401291, "uuid": "373bfd9f-3c1f-4a90-b69c-976ff2b34b12", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617401291, "uuid": "e9fea81f-d5b4-4fef-9258-4b5d0781e587", "value": "3072:Nopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:CpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617401291, "uuid": "7501522a-e0ad-4e26-a625-cc80d20ae123", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617401291, "uuid": "58ddd32d-8e78-476c-8422-b1adb9785cd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617401291, "uuid": "7085cafb-5dbb-4077-9d24-4b7aeaccc001", "value": "178969333087c7d46ad09f7c758244c97b328b38941ac9d81d74f89540dd90c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01874923-93a4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617361817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361817, "uuid": "74b78af7-902d-4f7f-b6d3-a855e9286edd", "comment": "Malware payload (AgentTesla)", "value": "cb5f5d97d01a813b7a4bb23b20aa85ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361817, "uuid": "5cd64ba1-13e6-49b1-b2dc-9baea17f2312", "comment": "Malware payload (AgentTesla)", "value": "18082c8a70a4b81b5ce2e4f781cc3e6f6a35f4ab150c95cde6b8f447fc75dd6a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361817, "uuid": "efbcb549-00ab-4065-b1a1-4624cc0a90bc", "comment": "Malware payload (AgentTesla)", "value": "0e50ba8eeb20a789962c130d3a6eaf7af180e14b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361817, "uuid": "8e98d70d-0230-41d4-9ecd-70a2b3bd883b", "comment": "Malware payload (AgentTesla)", "value": "1b3be78d73c1e45b4c6acce6ce2615626c76e7db79d2ff8a4c2b97530d556fbe1b35800e27a18659175197512242fd08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361817, "uuid": "cf53ea97-9283-41fd-bd67-f8b3dbdb98ac", "value": "FBA42304EB1E1A003DC76D21EF536BF5047360A92893A3473D15D74E76A78F98A93BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361817, "uuid": "ff096bd2-18c2-4916-97df-4659b0c378b5", "value": "12288:UISuAh+gMAxd+EzVrwkZ4WDhceN67ZuRkzIjUF9RtHQlwjrQWSV:ZSrdh7WWOq6NuxI9RtdjFSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617361817, "uuid": "03cf75f0-47ac-4d8a-91ab-b6af9f527845", "value": 488381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617361817, "uuid": "a43ee8a2-1099-4fed-a49f-c17484844597", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361817, "uuid": "79ab62d0-76f4-4659-9a0c-56a9797ac1db", "value": "balance payment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a66f110b-9404-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617403325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617403325, "uuid": "f620cb02-f0f9-459b-8a58-139924f96b3b", "comment": "Malware payload (Dridex)", "value": "34dbd62b942471f3f621386f7465ddfe", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617403325, "uuid": "fcd064e5-cc2e-4737-9696-2893a48a9941", "comment": "Malware payload (Dridex)", "value": "191301956ae441e2705dac855b3cb01f34d73ff789822dcfbb66af265253a42a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617403325, "uuid": "c01b8a7d-a534-488f-a72a-dcfcda558b11", "comment": "Malware payload (Dridex)", "value": "e8a3a8cd488eea5e7ba6f29ce82ee73cb7b99853", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617403325, "uuid": "0c06888e-2851-4e68-a777-d9dd6cdd5d2a", "comment": "Malware payload (Dridex)", "value": "87ad4030fa9cccc0359ea0bd2cb6e5c1f3b14a187082503f8f4d34af8a81c74fee7946a776ac6e0f610534926b82539a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617403325, "uuid": "8c360908-be6d-48f3-80aa-d05c8dab1c69", "value": "0A14AE9DD729E464FAF3D9F104359A1210BB6C49892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617403325, "uuid": "2e8e7a68-08c3-4e8e-a52b-4167fccb0c9a", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617403325, "uuid": "1beba6da-8c6b-4d87-947b-6ce613f3a871", "value": "3072:G1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Oi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617403325, "uuid": "a14468a2-500e-4899-8d6a-8aedb49640fa", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617403325, "uuid": "e85498ce-4936-409a-9541-5f9c6f7e7520", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617403325, "uuid": "f3ce1af2-0e9b-4cc0-8a36-c31bbd9fefb2", "value": "191301956ae441e2705dac855b3cb01f34d73ff789822dcfbb66af265253a42a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d7f573-9406-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617403920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617403920, "uuid": "d2a6afe9-248c-4967-8020-3d3728c304b7", "comment": "Malware payload (Dridex)", "value": "8caa378588fc5338fccaa4cc0e2fe353", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617403920, "uuid": "88503322-a913-40f2-9532-caa56f08e2c9", "comment": "Malware payload (Dridex)", "value": "1ac72c3cd2fdf55a4920cfdbb0df181e5f7e8623abd421ff30065c15591b96cf", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617403920, "uuid": "35d5e81b-01f8-41ac-a708-16325f2e9679", "comment": "Malware payload (Dridex)", "value": "52a1ca8f063abcc4dec0632d055745a0dd4471bb", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617403920, "uuid": "5f00be80-fe9b-4ee2-9672-1a4c251c1bfe", "comment": "Malware payload (Dridex)", "value": "2e034eb825e5728628ef62d22ee6794c3382cf15271885aa8f76aa8ff88e8ff2f50963050f40472b9012c11f94886568", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617403920, "uuid": "0bbf890c-bc4e-45eb-b620-03639e641a48", "value": "CA14BE4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617403920, "uuid": "fc1f7310-ca15-460a-b5bf-b87f53a512d1", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617403920, "uuid": "087f6d33-e30a-4158-8694-841bf3bd3473", "value": "3072:1opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:apjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617403920, "uuid": "9b45ecf1-1542-4e3c-a940-9d03ea095fb1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617403920, "uuid": "d61e19a0-e327-4603-af33-6b3ccd839213", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617403920, "uuid": "abb77500-3c2e-455d-971a-9c1cf4499f9a", "value": "1ac72c3cd2fdf55a4920cfdbb0df181e5f7e8623abd421ff30065c15591b96cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c512f915-938f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617353126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353126, "uuid": "f4bfb366-4fd9-4c7a-b429-ec6bbf780bfd", "comment": "Malware payload (RemcosRAT)", "value": "6c06c0b2f7ea9cbe47eaf1b5631729aa", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353126, "uuid": "a3270ddb-64a5-4ef2-9ac2-60cceb001ef9", "comment": "Malware payload (RemcosRAT)", "value": "1b059ab1c0eca910c2882e26ac6f2e8ab795f0749294dfff4af528cb788d2d47", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353126, "uuid": "0bbc3fec-75f0-4ccc-a75a-1e703c6b025c", "comment": "Malware payload (RemcosRAT)", "value": "740236022aed988ba719741df042f74786f29fd9", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353126, "uuid": "245fcf9d-2d5b-4444-9916-7c89ad6a690d", "comment": "Malware payload (RemcosRAT)", "value": "e729ca008e90479b681928cbd6a20789c2af98859004c2aac7e2e8bd9dedf75b0859d7d61dfa6c9ac2c1fa67fb0ca3b7", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353126, "uuid": "a3f5586a-4653-473f-8a33-e11d165a468a", "value": "F884F1D1F150C8DAED6B09F1AD2BA93024D7BE9C54A4410C569EBB1B76F3342209FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353126, "uuid": "da2aef8e-6dee-4200-9e03-8404e37451f8", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353126, "uuid": "123cdab2-1311-40dd-8cfb-2a02c24123cd", "value": "3072:0f1BDZ0kVB67Duw9AMcRolCzg2/lwObBnKmN+IeMVw3PPPlcH:09X0G5o8BperPNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617353126, "uuid": "c45b14eb-c033-452e-9c37-fd5df5d3e2c4", "value": 384327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617353126, "uuid": "85e16695-b05c-47bf-af66-623307fcaf49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353126, "uuid": "4387e3b2-5b9c-40b1-ba9d-8f8cd40157de", "value": "fatura 893454.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2863e68a-9363-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617333965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617333965, "uuid": "8be9427b-2365-439d-b26c-14557f4d2bc2", "comment": "Malware payload", "value": "b2afd7c99465972edbbfb890f9bcf369", "object_relation": "md5", "Tag": [ { "name": "www.sogecoenergy.com", "colour": "#460AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617333965, "uuid": "4ac11f4e-0244-4450-9a6c-6a57e0053560", "comment": "Malware payload", "value": "1b60035df84046b1b7d4f2f4d9d965ea9c14163eb1b84b078d99670ed6399b1b", "object_relation": "sha256", "Tag": [ { "name": "www.sogecoenergy.com", "colour": "#460AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617333965, "uuid": "95c0913f-0bcd-4f12-93d4-9344ad70e4b7", "comment": "Malware payload", "value": "77a36e4d8486c5515fffb12021a27e5a6659cdba", "object_relation": "sha1", "Tag": [ { "name": "www.sogecoenergy.com", "colour": "#460AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617333965, "uuid": "75193725-8b8e-4f45-9f30-dad9360ea4d1", "comment": "Malware payload", "value": "d818fb1feefdb00502cb2d440ffa2b01631a5ac6daec87af7eaf5571cc676523cd30cd50623bb36d8c23d97934bdd6a9", "object_relation": "sha3-384", "Tag": [ { "name": "www.sogecoenergy.com", "colour": "#460AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617333965, "uuid": "a6b18c50-7049-454f-87eb-17d2ff90497c", "value": "6AB3075378A88FF6CF328EB84E354BA8805B6E3047724747B0E5774D09F369CA9642C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617333965, "uuid": "a3934ae4-0dbf-4a84-a129-ed436a1eb79e", "value": "1536:sEExJtDM6+pb+4l1zHagvA+bwA+SZ/uXDyoPxt4E:sEE3tIvl1Oc+S1aPDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617333965, "uuid": "856dd524-90dd-436e-98de-7f463c6a62d4", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617333965, "uuid": "73587665-e94b-4a61-98cf-cb6dca465d80", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617333965, "uuid": "e654c25b-1f97-46ce-8c2c-57d544cacb12", "value": "1b60035df84046b1b7d4f2f4d9d965ea9c14163eb1b84b078d99670ed6399b1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3296434-9380-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617346680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346680, "uuid": "23a1f5d0-0c41-4b8d-a19e-7122d7089f9c", "comment": "Malware payload (Gozi)", "value": "b832d3eb777f5c896b2ecb481fb1a064", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346680, "uuid": "1a021267-91e6-487f-8f63-8162c4738f87", "comment": "Malware payload (Gozi)", "value": "1c968e3510ccf50b265b15997500b39edaa468f1abb30bcbdfdb75af944414d7", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346680, "uuid": "d9853fa4-757d-4155-a0c6-9673fa60b31a", "comment": "Malware payload (Gozi)", "value": "949b242a9e9f9456bcad66caee583c5871d3e4e6", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346680, "uuid": "06e75490-9535-4661-8855-1da9d0013570", "comment": "Malware payload (Gozi)", "value": "b3329d877136b42b86565b1c71e41cb2dd62042d5c066dd6b8cd615e96aa85f99f0416741f4b2c9880cd307818ee8c84", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346680, "uuid": "82321faf-0445-48e1-b6a9-72c8cc122c3c", "value": "CBA31231B3AFDD60BCDBD77AF4233E699152C71032423A15577938B9A026D0F87AAD01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346680, "uuid": "45a3ea8b-098b-44b0-afcf-a71d698b449b", "value": "3072:9Y+NvDSSELu/ABJDO9VMBu/UwWvqG/lxzW9DDC6+DU:9HvDSSEBJ2veqCBW9DDC6+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617346680, "uuid": "dc20ab6c-6aa0-41b1-929f-d7a96621f65e", "value": 99206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617346680, "uuid": "8e82f507-39e0-43a6-94b7-ab89bd4bd17f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346680, "uuid": "495896e6-6d17-4d06-93c5-06a907597bb5", "value": "request.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7caf4a-93de-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617387038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387038, "uuid": "aa2b0e33-84e3-4978-8004-44267c2d1662", "comment": "Malware payload (Dridex)", "value": "3f2022a8d6c765395ca1078ba647cce1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387038, "uuid": "fe6df7c7-184b-47f4-915f-58eed703e88d", "comment": "Malware payload (Dridex)", "value": "1cabf298f73b9af7cd77c9c9646a6238f45e6ac07ed7dd7a44517fd2650d55f2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387038, "uuid": "bb3046e8-4a34-47c5-9f00-12300942f8f6", "comment": "Malware payload (Dridex)", "value": "9dc06144fda7a84849d30c29d040270ce13e2597", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387038, "uuid": "e9ec3a87-98d0-49f8-9080-d25667da3919", "comment": "Malware payload (Dridex)", "value": "d430d02549fa534ab10a75181aadb8556b57f15602fa3d32a1ad56621a13d01fb5d7470ed7bda1d4fb8b87662800bae2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387038, "uuid": "17f082f2-7f90-4d94-a804-907d35a85c38", "value": "3AA4D060BD80E47DEB0D22705C4BEDBD0159FC0466ABB96F32EE2D6F15A1253F05B298", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387038, "uuid": "62ae505a-83ba-4157-b4b6-45e413356981", "value": "12288:ASts0Ljpezsf/Lrxn9AiQwvM8hZDgh6cV3:HtrszsHxfjv7Dg1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617387038, "uuid": "5b737322-4287-4185-9d2d-7a8798c62c93", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617387038, "uuid": "bbae05cc-0be1-4ec9-9621-20905e5b8cbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387038, "uuid": "d351a080-3aa3-4134-b9d9-3c0fed857ebf", "value": "3f2022a8d6c765395ca1078ba647cce1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63dc916c-93df-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617387322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387322, "uuid": "a63860d5-86d0-4159-af1e-9687ae56a1ec", "comment": "Malware payload (IcedID)", "value": "754d4bd31aa4a32145e2289c7ba8e03f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387322, "uuid": "fb985bfe-3dc8-4948-978b-7337b8e2c835", "comment": "Malware payload (IcedID)", "value": "1ccf537bad5dda0a79cfdaad5d9ab9cf5199c22556809676f0aeb2462a1dce15", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387322, "uuid": "c26e6ce0-8464-46f6-b18d-e5ff01767b60", "comment": "Malware payload (IcedID)", "value": "83749d62c237d1192eef830373ac59d5ea634a3c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387322, "uuid": "b5764ed0-ae65-4ce3-b648-9e74c74e4897", "comment": "Malware payload (IcedID)", "value": "1ddea447246d8c589cd9c87a38df21a277ab7a4e023e88892e904c55c851ee21e12b8d01ba5a680b17abc70a10ff9c43", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387322, "uuid": "dae1afc3-458c-4306-b433-68206f438343", "value": "1D530A8947503C91C0FEBD34F3A69A58931EFB30AA8F47B794C46BBAC47B5409723619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387322, "uuid": "a54f4655-ebac-4daa-9381-518de396a5fa", "value": "eb10ff98c4adb7472a591c82bd2ff673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387322, "uuid": "700467e1-2647-4282-8042-92632891c7f6", "value": "1536:caCAzXz8T6rLXah8lI+Idu+B3XbuF6dRiF:n/gTkXayetu+BbuUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617387322, "uuid": "416f6933-563d-4019-ae05-ef23af85b5d7", "value": 65568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617387322, "uuid": "5386339e-38aa-4e86-82de-7a2491e0f06e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387322, "uuid": "cb29c927-eeaa-4fe7-9592-c1747c1d1d61", "value": "1ccf537bad5dda0a79cfdaad5d9ab9cf5199c22556809.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6191a2-93a3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617361812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361812, "uuid": "f51f023e-1b3b-4da8-b4fa-6597e4107de2", "comment": "Malware payload (AgentTesla)", "value": "3070822dd911c6aa4f0139dc78e83c51", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361812, "uuid": "528dbbdb-860d-4f9d-8231-017dbde33f45", "comment": "Malware payload (AgentTesla)", "value": "1dfeef75d1a9dc01ec23c14e6bb3f26e095582bb8199958a8fec268f6370da02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361812, "uuid": "06ee6ea1-2b68-44ab-b5b0-138ef134acd0", "comment": "Malware payload (AgentTesla)", "value": "b157a337f46440bdd97a74fe31aec5b239f080b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361812, "uuid": "4f25f76e-d619-489b-9c46-d510f390da72", "comment": "Malware payload (AgentTesla)", "value": "f0f36afc9c88067edaa32f822ebbb4522175eeb2130998ccfd575697fdf890ce8be9876a51085c6a3506c05ecb1c2c08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361812, "uuid": "cac3b949-c29b-4b31-8097-5675ca46ad3a", "value": "FA25BE283B10144DD4B716395418E04CAFE67DA92CE6D6827EEE33E771B3F8307A459A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361812, "uuid": "b91dee38-bf44-4494-b293-8646aeaad0ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361812, "uuid": "abd2fd10-6b85-4687-ba66-ff7c2cf09557", "value": "12288:7wdUYxsgZFBGL6RNZJcaYHxQCp0bDXUmSHZFH:3g7TaS8UUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617361812, "uuid": "3ba05b33-6a38-461b-a87a-2a3e7649c6b3", "value": 988672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617361812, "uuid": "e6e8bcb7-a518-497b-bc19-fa4f3c9fa4e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361812, "uuid": "574971c8-5b80-4d67-a6eb-c05051fe1118", "value": "AgentTesla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f3f5c8-93f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617397679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617397679, "uuid": "8b575ddf-534a-4c62-af69-d3ce3d497984", "comment": "Malware payload (Dridex)", "value": "82a89da41bfce4b18037f1bc0540b8f4", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617397679, "uuid": "9382f7f3-eddd-450d-919e-93fcfb58fa62", "comment": "Malware payload (Dridex)", "value": "1e5e86449ee35cbeb37fafdd2e38845b7abd7ce246edf340da1fc069a03f2e63", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617397679, "uuid": "0573d3ba-113d-4460-9176-de130b7b6141", "comment": "Malware payload (Dridex)", "value": "540466bfbce3e3a2858433d22377ad5a80b3b482", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617397679, "uuid": "ec9a1f51-bf3e-4c7e-b8f9-738f4eb0e0c6", "comment": "Malware payload (Dridex)", "value": "52d8d09d93a748992769dfd784035295069194ae4723998ad8b011fe6e44946bd3a0d41bb9c1cd4f7a2b4bf22afe633c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617397679, "uuid": "95b1a9c3-6322-45a7-bfdb-03813ca34763", "value": "EA14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617397679, "uuid": "be204575-fd86-4a50-9e16-01c24b2537ad", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617397679, "uuid": "69a9ed07-bd10-4908-827b-f3357f5ea218", "value": "3072:jopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:kpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617397679, "uuid": "bebc8047-f75a-449a-8d04-61d48043f598", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617397679, "uuid": "67de6a7c-c665-4c9a-9716-02295a9841f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617397679, "uuid": "129b3e92-6520-4b79-bc11-7b4cf79928f1", "value": "1e5e86449ee35cbeb37fafdd2e38845b7abd7ce246edf340da1fc069a03f2e63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15637d6f-93d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1617381607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381607, "uuid": "7688b6d2-06d2-44cf-b9a3-627da7982fbc", "comment": "Malware payload (STRRAT)", "value": "66f69c5f381c13e6ac23bca8c7027e92", "object_relation": "md5", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381607, "uuid": "e8c3850d-6404-4adf-b449-6db97d82ddbb", "comment": "Malware payload (STRRAT)", "value": "1e797a5c79d8c3d81e3fee1b472d1fc31582c0b9745d2defbc5300b5f19a2338", "object_relation": "sha256", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381607, "uuid": "b7e831b8-9fd0-420c-94df-bda71a02be0b", "comment": "Malware payload (STRRAT)", "value": "51ab3c46373549a50c05f0db57ca968105d1fe32", "object_relation": "sha1", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381607, "uuid": "31d61d31-2673-4512-9d07-69290446f4fa", "comment": "Malware payload (STRRAT)", "value": "d30414698d0d73517236cd7da4a702e08bf0b0124ab1b9ceb012391edf74afc74f4a66121caf200b829723988d8330a1", "object_relation": "sha3-384", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381607, "uuid": "9882b535-78f5-43a4-831c-d9e994143e15", "value": "95F31274572E9E3242D3A4A682577A9813331379CE31F20F24DCEE0BB9126498D38E5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381607, "uuid": "0e514bde-0e5d-45d0-882f-e800ce770cd0", "value": "3072:Fp9i1UyE5RxxXAGfe8VgsoC6XK1LxfI59vlvC1Zy48iSZbSUHCoWO:j9VTXAG7gso4dxf8dvCa4Ri/Cop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617381607, "uuid": "ff1f6328-d412-4bd6-a1b4-b74daf1be04b", "value": 172158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617381607, "uuid": "476223cc-3ba5-44b2-a54a-75e116a1ff54", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381607, "uuid": "e214e06a-7fdf-463c-afaa-e9a978fc6324", "value": "New Quotation Request .zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bee9f0a-9391-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617353754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353754, "uuid": "f48fe52e-adcc-4a8a-9827-3bd4199c02e1", "comment": "Malware payload (IcedID)", "value": "8d05451aba55f305c6567335591d9b8a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353754, "uuid": "9ab539a6-6432-4003-a29c-780f8fa7f0fd", "comment": "Malware payload (IcedID)", "value": "1e79c881582c2c4cf58783513f9125867073f568cbe134c843cfb015e9b30b58", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353754, "uuid": "5d4dca3c-b038-4ec2-a55c-648c6695310d", "comment": "Malware payload (IcedID)", "value": "80b43e572c1323bac282a6e66e17888a24b9874e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353754, "uuid": "86d7a03d-370b-44a9-ba08-346171ef5ada", "comment": "Malware payload (IcedID)", "value": "2db2fba2040dbdf07240256c06ef1b51b33362b195c656201d2359db21932f37c0f6b9503b666478500700c41ef5cb29", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353754, "uuid": "fed9eac2-22d3-4d4f-ae6b-f702b5b0f2ce", "value": "F214F7935CCFB663D42F90F1A8A1547D7F30BCC413E297DBA9084B1AD993792A972318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353754, "uuid": "b1efa619-df3c-4275-a580-470639f19a25", "value": "3eb5471c5370e4bcb3be6637e4995a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353754, "uuid": "70141148-cf5d-4773-81ca-3676c2711360", "value": "1536:Vq8ByBeZnwLGM+NoV1XjeNSaziIz7Ja5j/Nj/IXoZcq+M6qaCZZtr2wS+FJZLT:Q8+Kjv4RECZnrDSGZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617353754, "uuid": "9c931393-7e67-40ef-b022-9e82893048eb", "value": 203808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617353754, "uuid": "eab73805-cb64-49bb-9d94-f1ba54ae58ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353754, "uuid": "ef9d4e17-e722-428a-a7e7-b6618d7eaba1", "value": "1e79c881582c2c4cf58783513f9125867073f568cbe13.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "933818e4-9396-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617356048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356048, "uuid": "952995fa-99ff-4e8c-99b5-c4b066b74db1", "comment": "Malware payload (SnakeKeylogger)", "value": "2f8c3132b1bfe4e93f772a309e834f38", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356048, "uuid": "555c6818-d121-4dd4-9421-86a703dc2305", "comment": "Malware payload (SnakeKeylogger)", "value": "1ecc895c9e3a68cf95fdf081b07eae62e91ab88d223d40ac71296dacb0b57d96", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356048, "uuid": "580436ec-861b-4c69-b0a7-5ba43ddd149c", "comment": "Malware payload (SnakeKeylogger)", "value": "e3889bb97cb46401273a93cab2086a9d78af6295", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356048, "uuid": "27ecc5ef-e978-4e6f-9f87-5de09d408c6e", "comment": "Malware payload (SnakeKeylogger)", "value": "032af6b45fd4f8760a03d845de4515e868330b9e6f5f6c088d147eab6ca496c84e7b34dff4ce8d03ee4f70c98f5e4eb0", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356048, "uuid": "ccea7a94-ebd7-4fff-9e73-dae79897ebe9", "value": "4D05399D3651B2DFC867CD76C9A81D64EBA0B47A930BD203A06315EDEA0D997CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356048, "uuid": "53cf646f-6be7-449f-8318-f7dda51ea0ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356048, "uuid": "e6c39a3f-6509-41af-acee-6f11542cbb96", "value": "12288:J72TcKTwrNH0EY/iXrmLU5HpLayIVbqQsykD0skNQ/mCVh3ABRbkbolp24m4X9cl:5wcKTwrNUEYKbmLUDaxsykDCQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617356048, "uuid": "94836c0f-816e-438d-8b01-78da47e41b81", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617356048, "uuid": "8225cbe7-ce12-4d2d-9d56-c38560b704ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356048, "uuid": "2428716f-e34c-4d99-999b-425aec4ba189", "value": "UxuAPhlxPS1zffA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df2ec23-9395-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617355395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617355395, "uuid": "5803b89f-7009-4ed9-8834-2a35402ecddf", "comment": "Malware payload (AgentTesla)", "value": "474a81aa700eebac9638b8499c73bc89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617355395, "uuid": "6eb26658-a6f7-4950-aa10-4f772219bcc5", "comment": "Malware payload (AgentTesla)", "value": "1f7b48840eee9799377106f7f32324a51a6fee37126609cd87deb58a49746e4f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617355395, "uuid": "6048dd05-d64e-4826-9e6a-a72b26994396", "comment": "Malware payload (AgentTesla)", "value": "9cf016ad8a351b5e232d8d7d614ce5fe95be25e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617355395, "uuid": "07552f72-f977-42a0-ad58-3abe138cf2c6", "comment": "Malware payload (AgentTesla)", "value": "31364d97562742601b6ed846b5a7b91900991b9c20693c1910b8ed647a7aa41c669fe1f3110d479141149ed7d488eb3d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617355395, "uuid": "c369e4b2-bde1-40a0-924c-a4f7c6115af9", "value": "B4F433F109F4C1AF2A9222BBF56D9EEFA850B1515939135208D0B7027319BFB1CB686D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617355395, "uuid": "b3368daf-f7cc-46e2-bcaf-a1bf641cdf1b", "value": "12288:+EcBtif+vev1tEd0a6NPX8ZSqa8BOffaiCNPRvWvgc3+NDtjtfP5/tqpVrhzioH/:Ww+veXNNMZF5BOfyiosvutxhF2Vr5idE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617355395, "uuid": "118b475f-7974-4d43-9f75-871dc8090132", "value": 766507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617355395, "uuid": "e2c6ae52-c0fe-47e9-9932-c7f685dae553", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617355395, "uuid": "d34213a0-6b0e-434a-b375-c80c84d2d65c", "value": "Quotation.pdf...zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b339cb2-936d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617338372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617338372, "uuid": "8279c06b-c44e-47c8-a031-edd1a76d3e47", "comment": "Malware payload (Dridex)", "value": "257460d3096134d8e625cebfc6984c9d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617338372, "uuid": "b148a95e-9f7e-4465-9a9a-9050eaf9238d", "comment": "Malware payload (Dridex)", "value": "1fcb5e0d614b1b603acd8af28d20bdbb27f958e8e088e3b55bab381d5626cce6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617338372, "uuid": "58921740-2937-401b-a763-7ee8061df418", "comment": "Malware payload (Dridex)", "value": "d11bb864e111f305cc3202862258289a4a3ffc2b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617338372, "uuid": "f2ec21e8-9fbd-4ef6-a316-e50d19f9543e", "comment": "Malware payload (Dridex)", "value": "76c2b93b789b956d61f17a6cc216c13d62f36213687f0edcdbbd53b5805940ea5383e77c4a3c4bf387c96820db43f39c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617338372, "uuid": "a5a33072-58d7-417c-8153-49b3059d0b38", "value": "AD248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617338372, "uuid": "0dc2460e-abe5-4fe5-b992-1cf90d43baf7", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617338372, "uuid": "ca857547-cb8a-4c35-8476-e6f35e801024", "value": "3072:56TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:5oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617338372, "uuid": "979497e1-7064-4576-bf96-453c0ace791f", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617338372, "uuid": "3cc9fcd1-4e3e-41d2-8233-ab5a375cf1a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617338372, "uuid": "cdf630e0-75d4-4c76-b88f-c25d4d545151", "value": "1fcb5e0d614b1b603acd8af28d20bdbb27f958e8e088e3b55bab381d5626cce6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc00ce5a-93c7-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617377162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617377162, "uuid": "cc2c3908-574f-4405-ba29-410a42319061", "comment": "Malware payload (NanoCore)", "value": "ff895b71a094aee2c5056de33249f402", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617377162, "uuid": "4e82fd68-db79-43f2-9360-b2f29da9ce49", "comment": "Malware payload (NanoCore)", "value": "216e8e00460546e458bf68018a257bb6421ee4dd3f312fcf7125368dbc40313d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617377162, "uuid": "08b23b3d-19ba-4fc3-9f1b-edb33ab0326e", "comment": "Malware payload (NanoCore)", "value": "ad603dfc71e8e14e83471dde32c17428469237a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617377162, "uuid": "d9e24681-2275-469d-a4d2-71db6fdf2aa0", "comment": "Malware payload (NanoCore)", "value": "66f9716c164fbb0e8fd772decb3e3e94dc85043f9c6812f512b2f839420c41aa04f839f2216e6f4dd0209a2376997a13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617377162, "uuid": "129248ab-fad5-4855-b644-301323a757c5", "value": "DC456BA8725472EFC897C9B3C9680CA4FAE1747A430BD617A057167E9E0C95BCF181F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617377162, "uuid": "b2838319-dfdb-47fc-9c9e-03a6d840b5bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617377162, "uuid": "a275193d-5594-48c7-ba00-6f0e6c7ec228", "value": "24576:NFLAJbUBgyRfwZIwSQ1rwx+AW9sAvR8DPcv3:3AJ9yCZIMgW95ocv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617377162, "uuid": "4cebaa82-4fce-4c74-ae9e-a4e3048a3a89", "value": 1237504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617377162, "uuid": "b0281762-f694-4035-b447-fb37ac5e5c0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617377162, "uuid": "bb62b689-e2fa-49ec-9ef3-717f0c696f65", "value": "SCAN ORDER DOC 040202021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "206854c6-93a6-11eb-abe1-42010a9c0039", "comment": "Malware payload (CobaltStrike)", "timestamp": 1617362728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362728, "uuid": "0a7da6ea-9d75-4d44-9fda-a2a1846e9b15", "comment": "Malware payload (CobaltStrike)", "value": "55743387d6331011dc4cfac1d1c56c3c", "object_relation": "md5", "Tag": [ { "name": "99.81.122.12", "colour": "#6905C0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362728, "uuid": "9a849e2b-5f03-459d-98cb-3349f14e25dc", "comment": "Malware payload (CobaltStrike)", "value": "21997a8180c9d1add6f4b7eb35d754d9a15acc614cdb5b11078eb5da661d9d3e", "object_relation": "sha256", "Tag": [ { "name": "99.81.122.12", "colour": "#6905C0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362728, "uuid": "ef6da2f8-b97c-47d3-b3b1-32c4b8e0fc67", "comment": "Malware payload (CobaltStrike)", "value": "e4b8986fbf9da698826eff850d227eb104011166", "object_relation": "sha1", "Tag": [ { "name": "99.81.122.12", "colour": "#6905C0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362728, "uuid": "555e7688-5405-43f1-bab1-49ecdd5a3763", "comment": "Malware payload (CobaltStrike)", "value": "f64faf16991fe58aa2b3c9d8613e1192ffa7b661a07472a4c11f77e12ebc19e430c45760d3cb1fdb67f92dc997e84d59", "object_relation": "sha3-384", "Tag": [ { "name": "99.81.122.12", "colour": "#6905C0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362728, "uuid": "22a38244-26a5-4483-8233-97b1fd2bbe6e", "value": "04820A7FB60228E9C127D17CC5EE67B1ACF27023417B671F2BB8C6302E219784669919", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362728, "uuid": "dba0c776-542c-4b9b-b87a-7fa71b656072", "value": "17b461a082950fc6332228572138b80c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362728, "uuid": "695f7f89-006e-40c0-b00b-24feb297eab5", "value": "192:a6A0TJAPyjLHY219R8C6wtQbYu2KmbxQ2C04kvWgepEt2ZpQOj6EUbOD6kxiY:PA0TJASPp6p/D43FvWgepDB6IAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617362728, "uuid": "5d63aac7-ec1f-49bf-8b53-642f19f1f724", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617362728, "uuid": "979ff331-06d9-47ca-800d-a3754e6921a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362728, "uuid": "28cbf5f7-db04-4e78-a64b-00169e38bc5c", "value": "21997a8180c9d1add6f4b7eb35d754d9a15acc614cdb5b11078eb5da661d9d3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e820a5-93a6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617362846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362846, "uuid": "59b35425-5f90-4a96-b5a1-4a4700ec2fe4", "comment": "Malware payload (Dridex)", "value": "fc919009236010804d17db769c47f017", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362846, "uuid": "f7547589-fec5-4157-ab23-4a150dc3befe", "comment": "Malware payload (Dridex)", "value": "21f7028fa91621ce9bcbec640f3bf9b19c7c6566a069440a2f1d7777577efbf8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362846, "uuid": "10c130f9-c56a-413f-9af3-497b6dd746ed", "comment": "Malware payload (Dridex)", "value": "142da839ece588ce64213dd7eca0a84a291060b7", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362846, "uuid": "1d93db0d-da31-4eda-a01e-5548a1aa0034", "comment": "Malware payload (Dridex)", "value": "19f6566afe7e5487a68cc8c75d63b512d59ae0a7db8999decbceee3a1e74fe7a08e8c197ed678d171fb9a42bafe5e515", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362846, "uuid": "9d550741-81ca-4c01-8117-6865740f4a61", "value": "BF14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362846, "uuid": "93c6699f-8964-44d4-960e-48c62e975943", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362846, "uuid": "9decbdf1-c6e0-4f19-92dc-7ad2ffa3c676", "value": "3072:B1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:zi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617362846, "uuid": "f3fb9c8b-aa4d-4c52-a126-05f6a8a5441f", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617362846, "uuid": "60c6f290-bf31-4fae-ae1b-afbb7cf1a7b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362846, "uuid": "469169da-9a00-495d-8ecd-6a039b3cbdb8", "value": "21f7028fa91621ce9bcbec640f3bf9b19c7c6566a069440a2f1d7777577efbf8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2421aba7-9405-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617403536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617403536, "uuid": "f240e7ad-e515-40eb-8b53-1e9dc54ce585", "comment": "Malware payload (njrat)", "value": "a31cc30d0bc48b179c7d1f00775c1565", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617403536, "uuid": "404cf444-64d6-4bdf-9e7d-ec67c982168b", "comment": "Malware payload (njrat)", "value": "226d74c26853c95905bc66fc0697e424cc3f0197a09bc072b3b5df022ba45dd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617403536, "uuid": "836fc50f-159d-461b-b946-809de3c71840", "comment": "Malware payload (njrat)", "value": "8467ec6228847bd926ed47ed27e2e4f2adb71f78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617403536, "uuid": "76f1a6a9-e552-46b9-8a51-3909d599b590", "comment": "Malware payload (njrat)", "value": "51adc317761ef125e9e591d30ee9a5f3c287c2221ddb89e132c62d2bda12b93a748562c0cd28cc97f1aa839aac23a054", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617403536, "uuid": "3cebd8f5-bd8d-4f4e-bde9-13a3ca323a13", "value": "6A13E78CB694E174D5FF8BF1B4A1B2990B71A01BA802D30F99F154D94B73EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617403536, "uuid": "3eb594a5-52e9-4ba0-9ebe-25f6aad746ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617403536, "uuid": "cbcefdcb-d782-4562-8111-e8071581fac0", "value": "384:5ZyVAtCxrmvYUy/fHiZF1cUEorCBHw5zoIij+ZsNO3PlpJKkkjh/TzF7pWnO/gra:bOA0Ygh3HcFeICNeuXQ/oH3+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617403536, "uuid": "fcc58aab-d2d5-4b33-a4ed-f39ec0974a57", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617403536, "uuid": "65304744-9014-4573-a0ce-a455def7ab41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617403536, "uuid": "32469c66-6eba-4f63-bdee-db977231ca71", "value": "a31cc30d0bc48b179c7d1f00775c1565.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7428a7-93b2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617367848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367848, "uuid": "a33bb3f6-48ae-4462-b9fe-4090f464ba3c", "comment": "Malware payload", "value": "75a6d0c7c0dbdca611ade0ca0ffcdd01", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367848, "uuid": "0865ffc8-1806-4b59-b714-268ddc9571fa", "comment": "Malware payload", "value": "2355c41d99a06c1b84e711ecd5491b9b264cacffefc1fd17f666b3383ba9b8a3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367848, "uuid": "aff8fd2c-b61b-4327-bd58-5cd1593552b7", "comment": "Malware payload", "value": "15001dacc821e4ed7d6946cdfb143d98b467a187", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367848, "uuid": "72eb87ad-8843-4635-aea9-afc35a127f80", "comment": "Malware payload", "value": "615641657353953e8e782a441ec935697875d88367c5551aa4a053c9b747704a8ff917f955ebd46ca539a5d4e9883956", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367848, "uuid": "3de6ab0f-4d5b-4db1-bfcd-d9a1ec860d89", "value": "20236BA088F520C0F13687B72DF92666F934381DF75A9E8F5048BD0572666F53236B5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367848, "uuid": "47430989-2df5-470d-805b-d56636d878f1", "value": "899ed385f326a8d1a9ab31e32ad45491", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367848, "uuid": "ffc77c0e-0708-4124-bf6a-3b19d29de0f3", "value": "768:MkClx2sQfcyCylq5HaoRfnKvtGW/wt05E6HZaPIz28+QC7SK0ZqxOWVXP:MDx2pfcyUrNYcvW/HZ80AQuBnrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617367848, "uuid": "d4dc5271-770a-4d40-b4f9-f37ea4207b85", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617367848, "uuid": "d8bfba9f-deb4-4799-9512-42dfa832fa3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367848, "uuid": "3f4bc7d8-51ad-4a85-a63f-cd3da92858af", "value": "cave-64.tmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe53ce65-939a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617357946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357946, "uuid": "e3cb28a9-93a1-436f-b5af-f59a9d6716dc", "comment": "Malware payload (AgentTesla)", "value": "aa11c426106c284614020f32e7a82551", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357946, "uuid": "c338b098-2fb7-4f18-a026-a83aea07518a", "comment": "Malware payload (AgentTesla)", "value": "2372eaddae0b9ff47b6cc45c9ac7a5c508c3cf6fb4ecf858d953b287692385b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357946, "uuid": "c051be79-1892-4883-be24-4865d4ba1522", "comment": "Malware payload (AgentTesla)", "value": "6dd7302da8bf7cdc083cc2e9a4d9ea3652b1ae94", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357946, "uuid": "c8d63992-1883-48cb-aab1-f9b25d31cabf", "comment": "Malware payload (AgentTesla)", "value": "a3ab6f26c6fc18844adc83725aa313c2ee1e3bb2476dd261ce1e6820228a93ee9bcfee4c1e105e00c774afd3817758c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357946, "uuid": "5651beb5-32b2-4420-9324-d38437f9dc5c", "value": "9615D01023F48654E56F077AE5BAC019D3FAF1D5B4ABCF0D8D6860DA3D2274C9C84AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357946, "uuid": "fa9e9701-cc3f-407d-bc76-76be1ff49572", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357946, "uuid": "11c89548-b041-4a97-b1b9-e7f12eea649f", "value": "24576:SCSSSjeNp6rWFB3Z5u6/6MqcQgn65UrNIdmQA8:rSjeN2a3/f/6JHgnlqEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617357946, "uuid": "2bf76526-9593-48ad-98b1-35c10b897eae", "value": 937984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617357946, "uuid": "3682e4fe-58b1-4b78-9365-cad6f3d0765a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357946, "uuid": "c0276a6e-71f2-4020-936e-4af4c49d6188", "value": "contact form.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ddb56e-9396-11eb-abe1-42010a9c0039", "comment": "Malware payload (Pony)", "timestamp": 1617356211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356211, "uuid": "11e07732-944a-4d66-9ab9-4e981269ad4b", "comment": "Malware payload (Pony)", "value": "9af3e9df6ba3ea3ba1cb381d82d02068", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356211, "uuid": "536484f9-775a-4336-914c-273274e2a77d", "comment": "Malware payload (Pony)", "value": "2396718872bb6f8a4828eb6590eae58adc2f2826678e08d6bb6030870c2aa960", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356211, "uuid": "90b3c9c1-9aa8-4291-9dba-30ac06257ff3", "comment": "Malware payload (Pony)", "value": "c4a1a164fdb8c97fbf8e146c609ff914b85cb333", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356211, "uuid": "a9d5ac92-de91-485c-8fff-bfef0dce3fe0", "comment": "Malware payload (Pony)", "value": "335c76fd2e905d5a6cdd677a56704b552b29c590327be2644208b365f6987bd9d92d7481db525a4a201d3fb006e5777f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356211, "uuid": "2f0b0da3-f51a-4062-8c59-a24e1d1e673d", "value": "AE156DB873E1F6B5CA294A7189133C3443F08CA7E971F556ACFCF8D08530EA56B1A586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356211, "uuid": "9088b65f-4010-4105-89dd-2356d6cb4773", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356211, "uuid": "540e3864-7d1c-4b93-a331-4edcd29a160b", "value": "12288:GJnZvGgQnvyx6yQOpkrgCVTbaakxaM9qBxaM9qootf8DTX:+FGTnQKHTsxF9SxF9h/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617356211, "uuid": "70188c17-7fc4-48eb-a802-930abf9c919e", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617356211, "uuid": "ff9fc49a-0ad8-4ae8-a47d-4f8964a9a832", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356211, "uuid": "8cdcd0c8-a593-46da-935e-7bcf25156e11", "value": "9af3e9df6ba3ea3ba1cb381d82d02068.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb84b418-9399-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617357431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357431, "uuid": "fccda601-1efa-4262-b496-b50e0d00f019", "comment": "Malware payload (AgentTesla)", "value": "eec830ecb1ebfb94d0cc09d9d11de36f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357431, "uuid": "1472bb62-2bd4-4fc9-9be0-8ae32fff1b42", "comment": "Malware payload (AgentTesla)", "value": "23eb242e4f23685da9d82fba572f068eb1ba1ea55f20bde41f30bd180e5688fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357431, "uuid": "705ca767-7064-44f7-ae7a-c6edaaa0b929", "comment": "Malware payload (AgentTesla)", "value": "ead37c9ff5a98b2922a5a94e7ce663c3fa74d06d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357431, "uuid": "469b1aa3-81b0-4eba-979a-abed4c150ba8", "comment": "Malware payload (AgentTesla)", "value": "0da8af3899d2facd89b143ed205793dd9b9ad53524ea7c5a6e02f7f100838d4338d54561ba5870a85eb8c83f3dfa1ca3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357431, "uuid": "379eaa28-c710-4100-a993-bf76f398425c", "value": "C335C0003294C898E11B17B9D4BFC018D3F9F8DDA46BCF0D1E46695A29E37096C967AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357431, "uuid": "1f0123d5-a95e-4664-be11-bbba27754ded", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357431, "uuid": "f5e3f1a4-0166-4015-8bdd-f31791dddf0c", "value": "24576:5qrCv+aq7VGeNxzoR2b6GNKl0ad/hmfWCjfdZqd8:5qzVGeN9Yw6Fl0adaWCOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617357431, "uuid": "0b9c339a-f798-43cb-b4f2-b90e5bc5a669", "value": 1145856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617357431, "uuid": "1e5f299f-09d3-45d6-82f8-afe712a3fbdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357431, "uuid": "907efe16-5d6d-4f79-91e6-ad44fd9ff723", "value": "QUATATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bdb019-93a4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617361926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361926, "uuid": "d06f5b14-d771-48d4-ad37-59ec345946b1", "comment": "Malware payload", "value": "1fd4183154ba86885e2dc27b4fa56131", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361926, "uuid": "166ac0e2-c782-43b1-82c8-f9a116f3e7e8", "comment": "Malware payload", "value": "2487c956c9fe036e5ce2a4ee46cf9ecc8fd3be052d80c6e716eab94ba6006d31", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361926, "uuid": "3b68f363-e890-4fbb-8ba6-55404a535197", "comment": "Malware payload", "value": "2cdcf110e0daa978a82e34a403b7c2d19ae56539", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361926, "uuid": "631483dd-5d30-494b-8695-500b0c173969", "comment": "Malware payload", "value": "ea9f82ee5fef156f706a039c01c02c5fbba3545a52bf2ebf9dfca6f800529780d6b5c40c18bf05aea3252f5d3b0b007e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361926, "uuid": "db035163-50cc-42ad-8ef8-88a1f63c6a3f", "value": "9383F600F2AA46F6E2A9533520F7B7380729BC9215F1CEB74F83F64D9C22622596537D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361926, "uuid": "8fc90097-01c0-4fdc-8b16-2b5195390cfc", "value": "4aba193ad6ee88afa02f77fb66816d55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361926, "uuid": "7963c007-7922-419d-98d1-e42a9f10e33f", "value": "1536:KwwHY6DYXKZOgwIhgZs2X+qEW4xctVYG:KwwHYZ59rPEW4xc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617361926, "uuid": "998fac83-f140-4b22-a3c8-b3283fdcc2fc", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617361926, "uuid": "a5fe4673-7b78-4fa8-bb97-107fc1e5dfdc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361926, "uuid": "eee8d28f-8b44-449f-893c-c97bb0d0fdcd", "value": "569390", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6baade19-9388-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617349969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617349969, "uuid": "1a0a8fd8-be23-4ddd-bcbb-80cba995e89f", "comment": "Malware payload (Dridex)", "value": "a18a269e3ee827c9eacce6fe89f8f7ae", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617349969, "uuid": "08bdcb21-dcb4-40ba-8870-b3dc5d7a498f", "comment": "Malware payload (Dridex)", "value": "253215fe9893bdb3d6916ca3c6582afbba4b340cc0aa422c4eb83f41105f6e70", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617349969, "uuid": "2e1d06e6-38a2-4bde-b852-56312b6c647c", "comment": "Malware payload (Dridex)", "value": "22adbc37812faabed5f4097bd0084d0b8d5830f1", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617349969, "uuid": "a5bed8ab-e6e8-475e-8f7c-b033ceae4ed9", "comment": "Malware payload (Dridex)", "value": "9a2267d8b7ef236daec7c42f89a1a3b28ae524f6b9516221ebab633ab9243fe9fcf8f630eeb27da1035cdcd2cede74e8", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617349969, "uuid": "fc7d10f7-498f-4294-a6be-d57433f24e51", "value": "6214BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617349969, "uuid": "fa57dfe0-0616-4ec1-a3fe-953f2eac51a4", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617349969, "uuid": "e84bc219-fac8-4129-95ee-afb55e805f99", "value": "3072:Wopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:ppjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617349969, "uuid": "c9c9e4f3-b798-4326-a361-feda82f3f626", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617349969, "uuid": "efa83c0b-be93-4533-85dd-8d618d0e56d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617349969, "uuid": "89e00dfb-2fe4-4295-84e8-6eb8c3685f62", "value": "253215fe9893bdb3d6916ca3c6582afbba4b340cc0aa422c4eb83f41105f6e70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f466f7b-937e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617345734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345734, "uuid": "4f92b13e-561e-47a9-ac58-0bc3d581f76e", "comment": "Malware payload (AgentTesla)", "value": "188595f9cd3bb43e5ac6a06c1db96ffa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345734, "uuid": "6ef1dd57-d93a-4eef-ba29-cb5712c8730a", "comment": "Malware payload (AgentTesla)", "value": "25922d6822859829e6d25812e8a420ee71953e096161d19849862cd0db1de535", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345734, "uuid": "6e7e2977-8837-4dcf-a25f-447ac79b51f0", "comment": "Malware payload (AgentTesla)", "value": "5f92cf8fca983681419d4190176c534ae146c5f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345734, "uuid": "53d56890-a81a-4b05-b86f-83821112605a", "comment": "Malware payload (AgentTesla)", "value": "ac24919e2d1edfb9177bbb0a057fdc878e8dc8addb38bc20872ceaf157cc83195445d2aa41fe15146f352785007bc30f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345734, "uuid": "c3361f8a-112d-45a0-97df-2326533c693b", "value": "0A15289DB25072DEC857C977C9B82C74FEA064AA430BEA43E45311EDA90D99BDF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345734, "uuid": "928bbbf8-430e-4d8e-a786-c36f135a09b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345734, "uuid": "d8b54c38-93e1-4e52-9573-35ced24bc581", "value": "12288:XMwWytOLzxw28ZS8OgzZzO8Vod7ZMQeczu/NGlLHNLu+KWynJz7CDn/tZ4EeH7aM:cJj0968VQ7rkGlLtLu//vCDn/z4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617345734, "uuid": "af736827-6162-46e3-8507-685320e55052", "value": 891392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617345734, "uuid": "9a245e4f-6ebf-42d9-803a-75681fc7fd54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345734, "uuid": "428c0808-765c-4335-b86a-45b6cb7212dd", "value": "Po__04022021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b836b73-93a4-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617361887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361887, "uuid": "0046f2be-fef2-467d-b8a7-d9cb90ae7bc2", "comment": "Malware payload (IcedID)", "value": "353739e1fff2d0ee8600db5a3811ce58", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361887, "uuid": "e833eef8-44ab-407e-ab78-6552c028ddb6", "comment": "Malware payload (IcedID)", "value": "25c0a35edf959532b7924afd6e57578404f3ac2ee47e92df94644c31c757e091", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361887, "uuid": "9707a280-b392-422f-b6f3-0616609aa3a8", "comment": "Malware payload (IcedID)", "value": "cafa65731246a25e36710996cf1295dac43c11b5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361887, "uuid": "9bdfd94a-9af7-470a-a4ff-f5b9f7b88264", "comment": "Malware payload (IcedID)", "value": "89db4e6efceb12a6f7e9d52396a9c18c28d9d05e8e0b1b449528c23d407ef443ed6160cebf83460e8ac9614b6bcc0b48", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361887, "uuid": "dd1214d1-0c80-45a0-a3ff-bb3ef429974d", "value": "3B53298D6B907CA1C0FDBD34E3A19698821EFF309A4F47B794C5AB79C0AB5409623749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361887, "uuid": "02fdf22b-bf26-4c2d-b6a2-b557a46036f7", "value": "eb10ff98c4adb7472a591c82bd2ff673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361887, "uuid": "6aa4c070-fb4a-46fe-a98f-0307f0864bb9", "value": "1536:fmXIFRBSvf0EW6SL504jXnk1Nzva2Xj3108/lv:dbafVsL504jXk1RvlXJdlv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617361887, "uuid": "0c6c5c0e-2a5c-4168-9a58-66ef6cb0ce8b", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617361887, "uuid": "e3554e25-f0ce-45c6-80f7-cfb15d942197", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361887, "uuid": "3bc215f7-0862-49a3-808b-f59963d99607", "value": "353739e1fff2d0ee8600db5a3811ce58.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "199a9169-939b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617357992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357992, "uuid": "9363853c-1a5e-49f0-8f5b-f1893fcb8a0e", "comment": "Malware payload (Formbook)", "value": "3b9fb3a0f35df651e99aa7dfdb64445e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357992, "uuid": "558dc093-c1e5-4115-8283-54e13262e046", "comment": "Malware payload (Formbook)", "value": "26ce9b59c995e5c009089e28caf8c89c6c41e7dda928186f7114d9af26dca817", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357992, "uuid": "9280006d-63f4-47f5-82ab-849460fe510c", "comment": "Malware payload (Formbook)", "value": "93f2eed9bb5b57a58e8b7b09e0cf6afe687884e1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357992, "uuid": "a98d0428-5ae2-4d54-9225-2dd1d2e66ccf", "comment": "Malware payload (Formbook)", "value": "cdf6a14e250d04151b0e0db11145e8176ff37b04c43e34628fb72e6c9f2012ddc0206b0e38b3b84b014f37a56f0e1374", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357992, "uuid": "2aca586d-3721-46b2-8004-357a1acc7767", "value": "B4259D1A3F64654CC0AB07395829D04C9FE67D99AAD3C2C37EAA37DBA073F1307A4552", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357992, "uuid": "acf5f536-7029-458c-af60-5352b739f62c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357992, "uuid": "cac0090f-e48e-4f58-b9af-90b8e694fc73", "value": "6144:7OcGaIqa5EKoPAj9PW9wYJfjJ6oKeHFmze/Ejw4/t5onUMUFF8WwCbZxXd7Quypi:6cBKoeW5j0eldZqkAF2QTXd7QuTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617357992, "uuid": "0002efd6-6e84-4f67-9af0-4e4ecaabf646", "value": 1037824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617357992, "uuid": "c1fb6bc8-4a05-48c2-8c81-f3296c0f2bc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357992, "uuid": "06209a4a-e753-46ad-aa57-173dc890743e", "value": "QUOTATION REQUEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16fbbb2a-9398-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617356699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356699, "uuid": "b7b7da5f-6041-4b53-8323-809f7a09f17e", "comment": "Malware payload (Dridex)", "value": "24d3306635eca1e06d4bf436ea5cea15", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356699, "uuid": "4feca6ee-4fa2-4f7b-9bf4-c73c8b76acf3", "comment": "Malware payload (Dridex)", "value": "271a0731368fe54d2f2ec20ccbc385c2e79434f1ffa02f293845942c3b3e5f6e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356699, "uuid": "f6826ac8-db3b-44d5-b373-842c66f3de68", "comment": "Malware payload (Dridex)", "value": "4d281b655f11c18934622f4bfc2c4152ea3c046d", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356699, "uuid": "cb570f08-6b98-48e6-8668-aaf327332547", "comment": "Malware payload (Dridex)", "value": "57d0093962cabddbe8afa122648b24dd2876c52e6518da4fcc279e5b2fb8e1708e165cfd06a9a6d1203d8df0207e8e78", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356699, "uuid": "c8dc7ab6-f93d-4513-8dab-5fa3ee100687", "value": "E914BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356699, "uuid": "3de62068-e2a1-4529-b221-32603bad78b2", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356699, "uuid": "40100c90-a4d9-4032-b0b6-25d5a96a9a25", "value": "3072:2opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:JpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617356699, "uuid": "85d53eb9-6640-43b1-a9cb-526026b80ab8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617356699, "uuid": "165311aa-da34-4818-81a4-0afab782be7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356699, "uuid": "9565b211-c56f-479a-8623-1769e96d76f8", "value": "271a0731368fe54d2f2ec20ccbc385c2e79434f1ffa02f293845942c3b3e5f6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4765fe7-9392-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617354467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354467, "uuid": "7c232a08-682c-41bb-a815-10b9d1a14324", "comment": "Malware payload (AgentTesla)", "value": "1d4ce470661ccff7d1cf20564a253d92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354467, "uuid": "1aaae99f-eb54-4349-9cc8-a80485ca337c", "comment": "Malware payload (AgentTesla)", "value": "27f47dda959af174fb8d5dceb4d1abc99fa1f7c28160ee217a98f57bb03144be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354467, "uuid": "c55d6951-acbe-4f7d-ada1-d0cca85979e9", "comment": "Malware payload (AgentTesla)", "value": "ba2b51c06a50868d1e733791f3fcb2bb2669fc02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354467, "uuid": "7eb59b7f-d903-4324-823f-5eb431310ebc", "comment": "Malware payload (AgentTesla)", "value": "1ba91757cffda7465becfbb7dd7a351bfe20f49c31d9ddd4846ad1cd41b8dd09e15c3661b95910b6c49b638853aba108", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354467, "uuid": "992b1a59-b5ef-4dd9-a782-f1fd57dae5b4", "value": "A6C4DF14E7AC4B5DE07E57FB407032343FFDA195D252FF89EEE120AD29627818462B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354467, "uuid": "e8be04fa-af79-49f9-b0a5-88dd2ce13fff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354467, "uuid": "591313ba-5477-4edd-9f2e-0861d8b4b9ae", "value": "12288:/mG8pgkjkv9pI78h01DHiI7ahiyZx5KVk0EIOeW8QG7j8:/98m1GTVaAVk/Izx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617354467, "uuid": "27679d95-5771-437d-91b5-fb548002a248", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617354467, "uuid": "1547e6d0-5566-42fd-8b07-9dcbb939e80b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354467, "uuid": "5a440d76-bab1-4a30-b64b-2b4a88bff296", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221cb0b1-93b2-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617367885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367885, "uuid": "a909d46b-f914-4810-8536-47e537104756", "comment": "Malware payload (IcedID)", "value": "0c398cd7a7f62cfcca922886f3f0ce9e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367885, "uuid": "a14efb29-df50-477a-9742-9b37e9407741", "comment": "Malware payload (IcedID)", "value": "281ee6c8ec6c393e11fbc5e41d6ac30720c975f3db44f9d6a2017ecc28679a76", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367885, "uuid": "ee8f58ac-22d4-43ea-9c22-a2f1e2a025e7", "comment": "Malware payload (IcedID)", "value": "21a5b9d272aa59648f9a72cf4955a26032f48d45", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367885, "uuid": "402df421-56bf-4691-af30-5d932f786648", "comment": "Malware payload (IcedID)", "value": "2e51016a4853876236c00597fc76776e8040f70788374508d7403678043a03ad3209a51facb38ed1e300966d7a9e7426", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367885, "uuid": "91c62cf9-1610-4727-9f3d-6269d7c888ab", "value": "271408CA88DF66ABC82F81B0B4A40F3D07243AF547E697CBDA281715D5CB7D5E852324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367885, "uuid": "e3b98333-337f-4a4d-b42d-cdd027bd3b5f", "value": "bc76ade5e3961b619a50b800daf6c158", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367885, "uuid": "896a08e6-6ecb-4232-9adc-8469aece6df4", "value": "1536:VKSBy3lkoC5UchQqbjZxcDTDh3XUDU37/UZ3hFR+Gq0QRqKlMyoNBQT/K5InG4X:VKbkoC/hQqbjg0oLyR7CTc7FHQbqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617367885, "uuid": "ede7531d-e388-4e94-b263-00b2bcbb5c14", "value": 203296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617367885, "uuid": "b025d85f-6412-4a74-98ea-62681412b31c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367885, "uuid": "84491520-c7ac-4a2c-bdab-65176e7fadb6", "value": "Hodas.vyur", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394abc96-93db-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617385533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617385533, "uuid": "896bcf2f-5ee4-4094-921c-0d16c8bb75ea", "comment": "Malware payload (IcedID)", "value": "f41775f135cc74041eab79fc4de695b2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617385533, "uuid": "a7f26710-6f69-41ef-9a8b-73191932b6b3", "comment": "Malware payload (IcedID)", "value": "2983c60d9d2d6bb8b693517c34e034723b336be5843f4838d6569b5e9b7035ae", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617385533, "uuid": "b5b1d23d-59da-4acf-be3a-29e9fb05b21c", "comment": "Malware payload (IcedID)", "value": "cd59d51c8416d0633248bcde659494f11c2644e9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617385533, "uuid": "c4592903-04a2-4b6b-b80e-47eb43e446e4", "comment": "Malware payload (IcedID)", "value": "6474fc8eccec68abdd9cb3cf6b72a52af1b1c7a6872d3e4bd32ee59273be91aa4548397c2a205520ea7619a226d9eec8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617385533, "uuid": "7d01d339-cf23-41af-8ac7-1100ad99133b", "value": "77530A8947503C91C0FEBD34F3A69A58931EFB30AA8F47B794C46BBAC47B5409723619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617385533, "uuid": "0b66af65-3c4e-4e46-815b-d8c80fc08ac9", "value": "eb10ff98c4adb7472a591c82bd2ff673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617385533, "uuid": "c9d0fc80-2c42-48f8-93d7-8b713fb73842", "value": "1536:caCAzXz8T6rLXah8lI+Idu+B3XbuF6dRiF:n/gTkXayetu+BbuUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617385533, "uuid": "de60ea11-953a-46a3-8109-f8dcbddfd588", "value": 65568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617385533, "uuid": "206b6ce2-6343-4e4c-accd-5fb782442eee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617385533, "uuid": "3f423d89-0d71-42b4-b54c-4a3fff2fde88", "value": "2983c60d9d2d6bb8b693517c34e034723b336be5843f4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f82273-935c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617331112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617331112, "uuid": "d3c5d144-cddc-424c-a1ee-5945a00db776", "comment": "Malware payload (Dridex)", "value": "d7d02d5c3af1ee02174c25244ab789c7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617331112, "uuid": "fff46f87-3bd2-49c2-914c-591c6e51056a", "comment": "Malware payload (Dridex)", "value": "2bdadc28480284c22e8564d503ec16bed36427508bf5cd550a452b13bb9fc423", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617331112, "uuid": "0ef34a8d-9b38-48c5-aaf0-338265b94225", "comment": "Malware payload (Dridex)", "value": "bd366dbf4520ed5fc81ee1953a6308f613c87335", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617331112, "uuid": "5bc85110-de0f-41b9-a367-adca4296b853", "comment": "Malware payload (Dridex)", "value": "c57e0249d4f2dbec0e4d3d3937768f9599f06f79f2a07478b0c00af56ac66d02fc0c222cde6e6e41c907447ceff30382", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617331112, "uuid": "d02d2b29-e34c-4ac7-acfd-7a36ea40b66d", "value": "40248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617331112, "uuid": "070895f7-6faa-47b0-9758-01e7420607c9", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617331112, "uuid": "32cc4bd8-d783-4ee8-aac1-45fb40317c03", "value": "3072:R6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:RoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617331112, "uuid": "006c4912-966d-4d6a-9c74-63efa0aab89e", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617331112, "uuid": "fdca74b5-b342-416a-8ae0-93f33e2a00f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617331112, "uuid": "469638ea-bf07-46a7-b932-c4a07ba7ea3e", "value": "2bdadc28480284c22e8564d503ec16bed36427508bf5cd550a452b13bb9fc423", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f62af7-93a4-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1617361930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361930, "uuid": "d087a21e-4582-48a6-8fb5-47d5d24d5cbb", "comment": "Malware payload (TrickBot)", "value": "90a83cae8829e3afa721ace727c20234", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361930, "uuid": "b9b8890e-3730-4083-a67b-8655c7bfe1f4", "comment": "Malware payload (TrickBot)", "value": "2c18dc7deccc56fbc7992651102cf8d40d665df570f5d36acc5deb9b53d69083", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361930, "uuid": "c9b5588d-06a1-4001-a55b-d63484a4273e", "comment": "Malware payload (TrickBot)", "value": "060c4cf70bd573f0239e44dce45015be240cdfd3", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361930, "uuid": "852555f8-abfd-4bda-a0d8-b847be96008c", "comment": "Malware payload (TrickBot)", "value": "d230184224d0704a48e6b1f040195eee911156a28d0140076b0bfbaf3e6cb764bd124da027f77a05fbd4121c9f68b048", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361930, "uuid": "7890be7d-793f-44cc-b058-3d5769e7ffd9", "value": "F814136E8A027DD5D5B178BCC74818E69C8D247ADB43EF0564BE28201FE32CBD6CD258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361930, "uuid": "8c86faa3-2e0d-461a-9ec4-380ae97b40a2", "value": "6144:pkYxzdKp9YPfFC0b64hCmVKyTlZ7E+5Eyic/E:pkcZK2dq4AmBpZ7J6SE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617361930, "uuid": "0111dbc7-ef11-4227-83ad-460b5b009437", "value": 206317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617361930, "uuid": "7b14d02d-a928-4578-8caa-9e7781cbbeb7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361930, "uuid": "c817e0f4-5faa-4d50-8e0c-cae16fda2d99", "value": "_____.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17f4b59-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617386647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386647, "uuid": "58d1b14b-6643-4b92-9874-bc996903acc2", "comment": "Malware payload (RedLineStealer)", "value": "3594572488e00679a144001e24c675ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386647, "uuid": "0f421fc8-ceae-41c9-b1ed-33eed0bbd6f0", "comment": "Malware payload (RedLineStealer)", "value": "2d7dade7b01c47cb4157d57801cabd54d8cb1694cab0f4c2cbd0c4e5580f96df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386647, "uuid": "3f087a63-baae-4b24-a064-718b101df2df", "comment": "Malware payload (RedLineStealer)", "value": "95b99d41ed02cbf222ba3018bb275862a7875744", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386647, "uuid": "b554b078-8fa3-4203-a917-2d721f3fa6d4", "comment": "Malware payload (RedLineStealer)", "value": "baa6a7b71df4c950c0f4ac2009fef93f30cea2321d2d4c363e6500f263344733b65220ef159728d1f3597bb6793471ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386647, "uuid": "2ea49078-da7b-4b6d-8cfb-06425af9c2db", "value": "2BB4022071C0C1B2D5B7013144E6CB3A9F7971760769D2DBB29C6BBA6E123D1A7362CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386647, "uuid": "2f76748a-b3d4-4293-b4b9-df2605288114", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386647, "uuid": "834217cb-d391-47fc-aad7-c1d97b367127", "value": "12288:/h1Lk70TnvjcePHtwkfY3CuEtpdoGD0ORl7dj:7k70TrcePNwHIaOr7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386647, "uuid": "cdcd2d2b-4646-47f9-bd74-7397737eb064", "value": 501760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386647, "uuid": "cbfd66f5-8e40-4c66-a671-d83b5d037f94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386647, "uuid": "c10b2cda-ab64-4383-8417-e46792b5766f", "value": "valoranthack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3dace51-93ac-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617365606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617365606, "uuid": "638ce533-a55e-4f07-bb1f-c724270ebe85", "comment": "Malware payload", "value": "9ee9dacd6703c74e959a70a18ebb3875", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617365606, "uuid": "8ee95358-4b7c-49d7-98b0-b7733c517ac5", "comment": "Malware payload", "value": "2dc236bfbf03b29eabb1fd454d95634bfaa1184bee74ebd268c1ccfc04c4b4e6", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617365606, "uuid": "a680bfa4-389a-4771-9283-078838b678f2", "comment": "Malware payload", "value": "7d47038bfd277450c9907219aeb7f10eabaa348f", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617365606, "uuid": "1e080a50-25da-45dd-a49e-49e9451978d9", "comment": "Malware payload", "value": "f09f3273bb91ca7d7d1f5da409b4e5cc39262758aa7fcbf6b652a0115c403f958f716030c0d844b661abe54e0a844ab0", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617365606, "uuid": "18f868a4-70c0-4842-9c3e-6014e09b90a9", "value": "B982C078C5AAF916E4CD80BC40963A92F10C0417A7C1E436BD11F2BF95191EB2797F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617365606, "uuid": "6496cfb0-1a8a-461e-91f9-8353a69f02a4", "value": "384:tmtJPJuhdV1t7Rd5MlH7J2ridNQAtHB3H:qVy/t7/QH7JLNQKHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617365606, "uuid": "6b575661-9cd4-4a26-b8e6-89c698dee18c", "value": 18009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617365606, "uuid": "604f772e-b215-44d8-a31b-800b41fb8e7a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617365606, "uuid": "079a07b5-b8da-4cac-8892-d5263c521ae9", "value": "2dc236bfbf03b29eabb1fd454d95634bfaa1184bee74ebd268c1ccfc04c4b4e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055b5510-93de-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617386734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386734, "uuid": "08319d4f-81c5-4c7c-a6b5-468bc66e0911", "comment": "Malware payload (IcedID)", "value": "77ec67b8634a9f9d0347b566923d9e3a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386734, "uuid": "119210f4-d11a-4e59-9bc5-f0f2b5ef6cbc", "comment": "Malware payload (IcedID)", "value": "2df26b02cf345db5def232de5d2a4c819f7b43971e000233281d6bbdd2f59cae", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386734, "uuid": "f68697f2-2e18-4d95-b1de-9820a8905dd3", "comment": "Malware payload (IcedID)", "value": "8e04a57c28b80deb02a99448979314afbccbd1eb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386734, "uuid": "8f2d3248-8a44-445a-83bc-db4963f8c729", "comment": "Malware payload (IcedID)", "value": "97c05d1c2e30dbb5ba713cfd622f6b461a9175e7e3eb0d5631a5c5166f8766a37b4f719f525a9f1e3dca25cfc33966eb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386734, "uuid": "ab708819-1b35-4423-b9f3-e09b19b0d75f", "value": "E0530A8947503C91C0FEBD34F3A69A58931EFB30AA8F47B794C46BBAC47B5409723619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386734, "uuid": "6518a968-2a4f-44ee-806d-fe93d6cc732e", "value": "eb10ff98c4adb7472a591c82bd2ff673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386734, "uuid": "4e7be0bc-944b-44ed-9e94-c2d12bbaee71", "value": "1536:caCAzXz8T6rLXah8lI+Idu+B3XbuF6dRiF:n/gTkXayetu+BbuUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386734, "uuid": "d01db6a9-0e36-4eb0-9fdd-652302d3dc75", "value": 65568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386734, "uuid": "acb97a41-76aa-403f-99b0-b8526c613ef2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386734, "uuid": "745d212c-1f03-4650-b623-2fea2126fd79", "value": "2df26b02cf345db5def232de5d2a4c819f7b43971e000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0d7dde-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617386448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386448, "uuid": "639d642f-f191-46af-a2d2-f72c0c13360a", "comment": "Malware payload (IcedID)", "value": "77420f991ee55ce370e1bfbacf7e811a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386448, "uuid": "3d31fe95-d4c3-48f5-a24d-081456a5a377", "comment": "Malware payload (IcedID)", "value": "303210012d917fd7312bd7694a687d264804757bb31ffd61f55972a231db32c5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386448, "uuid": "0b3dd196-f845-433f-a4b7-0f20c3ef2adf", "comment": "Malware payload (IcedID)", "value": "ea821ee9d2a188444c7c357eed1b756fbd838575", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386448, "uuid": "b75914e3-5511-483f-9ab8-0afb31276dfd", "comment": "Malware payload (IcedID)", "value": "83af70dd79d1e747d03ad3f859be12c0e4c95beeb748e132ef004a76e96b808705b8ca88d11168e32dc0b21155cf820e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386448, "uuid": "46319b37-a0f6-4676-8b0d-214a3dc95d14", "value": "A904123CD0274C58C2E5447BD858C246AC6A2427ADF8A5ED668CB994EA137F30F7FB44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386448, "uuid": "a8c48270-98eb-4aee-b6e2-eb7ea5bdff1b", "value": "3072:dXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGDKJj:hE5SDvbXAyHbVt15wTQD0KJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386448, "uuid": "3de7d980-d63e-4aec-a1a7-1951b779d2a5", "value": 176993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386448, "uuid": "e02e89c4-ce80-4ebb-b5c7-5ee89aac87ba", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386448, "uuid": "a477d676-630a-4965-872e-154c1266273b", "value": "91408811036-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f78e4b-93b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617367626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367626, "uuid": "7479ede0-1715-4217-bf84-4bfd10f7a964", "comment": "Malware payload (Dridex)", "value": "b1cc23d8e2ed9759204a0767a86a6d0a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367626, "uuid": "d563a318-82c7-45e6-9bd4-b9eff6fd9753", "comment": "Malware payload (Dridex)", "value": "30563266b4b581e0bec2dd22501466b7318414292b8f4af182bd200d69226934", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367626, "uuid": "73c64ab7-2978-46a0-8da7-f3a87a75ee76", "comment": "Malware payload (Dridex)", "value": "8cd670eef9caf61841ba0ba6183c7c3a0439164f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367626, "uuid": "75226c17-6bff-4df0-a1d0-533251d17302", "comment": "Malware payload (Dridex)", "value": "4b9204c7bcd6e98886c29cdaf0eacd68e70ccb6b744607eeebbb571d8ff5da04f31e54da6e0a1bb372f096965e3a994b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367626, "uuid": "e343dc6b-d09a-45fd-8e61-c5ae3f59d59d", "value": "58248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367626, "uuid": "7d4b07c8-20a7-47bd-beef-12dfd51f4207", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367626, "uuid": "4fc30863-08e0-4837-8933-d5070a35766f", "value": "3072:V6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:VoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617367626, "uuid": "994ce49d-255e-4c83-bd11-3e867c1b65f3", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617367626, "uuid": "dab79baf-00a1-45b0-adbc-ccd65187ae97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367626, "uuid": "ffe06cb9-00b8-4ca4-aef7-e0d275a68606", "value": "30563266b4b581e0bec2dd22501466b7318414292b8f4af182bd200d69226934", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83132113-93de-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617386945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386945, "uuid": "3d3cff7c-2440-4e8d-8713-1783621e0d77", "comment": "Malware payload (Gozi)", "value": "9fbe59a22e56b3625c4371c0d486a3a7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386945, "uuid": "60bfac1d-99e8-4805-8fc6-114b35cf5ca7", "comment": "Malware payload (Gozi)", "value": "33439b8dfd712e802c8da57016f04842f97047fcb875fa53fb7e34d2e876fc9a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386945, "uuid": "08f6ab6e-1918-4bbc-9f27-85f18c4ce5a6", "comment": "Malware payload (Gozi)", "value": "3bd394b0fa503f1f98cd11f787963116ec44a80c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386945, "uuid": "3456eea8-8115-40e9-b347-f64f70a2c90c", "comment": "Malware payload (Gozi)", "value": "245fd88777072ff551ca4f2f2a8e62e15ebac2378e8222c2d8a2a581731fc8e79d772f866f433d33c3e7afa2285e4ab1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386945, "uuid": "f4323151-4a90-4ad9-ad33-4675b5e01bf2", "value": "B5B3DF00B9DCC4C1D3EA99B049A4DE75350AEDA62834900733F37F6D7EF63A629AB544", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386945, "uuid": "e4f1e892-8e8d-49d4-9981-29c51e169529", "value": "811de8e945c2087a6e052096546cd842", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386945, "uuid": "feb26942-c77a-4dec-bc69-87f044137d0e", "value": "1536:DWKaY5Se9WnVI78XvnoxJasJvRHKmyGDvDk0Rt9Y56l5ZMpvV05o9OX5xPw8:DWa0eQnVI7qCqZGDvDk4wol5w0EU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386945, "uuid": "7274f619-3204-4dc2-a267-8a33fb07ce14", "value": 117197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386945, "uuid": "699f9eb5-16f7-4d1d-9833-4d33439542b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386945, "uuid": "2c29eea9-e0f4-4105-9dc0-312591d38eb2", "value": "9fbe59a22e56b3625c4371c0d486a3a7.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66afc7ce-937b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617344377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617344377, "uuid": "e252e10d-2051-4566-8f40-f372776f08e2", "comment": "Malware payload (AgentTesla)", "value": "ea4b046e48c51671e13333173f9df2d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617344377, "uuid": "4ae8f493-df01-4346-8ca3-9c63c9d461cf", "comment": "Malware payload (AgentTesla)", "value": "33b82363f65067cd78f1f49b1686d918d3e2aa5c610c641d2c7063c8014eefec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617344377, "uuid": "d7f61908-a360-4964-bc16-678e2433caf2", "comment": "Malware payload (AgentTesla)", "value": "44515d173497841457869bae5ac531b09f3f5626", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617344377, "uuid": "7bfa714e-c824-482b-9e57-07e56edeeb30", "comment": "Malware payload (AgentTesla)", "value": "4b6e0fd81cbb1a1ecfe3dc88eedba5378b9c5624c5b5a7ae288c78f1871818238eaad80d3e8ba342d70aacdb6f7ac467", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617344377, "uuid": "7e5705fa-1441-4eaa-87d8-ea9fbba5fc02", "value": "4DB423FA9D1FD3C354D77B8750602EB1EB38A3955129BA614F81476B089322B8F72BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617344377, "uuid": "41304454-e370-43ef-b481-d5a2474cf48f", "value": "12288:1y2oZYnk/uDHzlqCtr9rU2gf4HaTOujv4xBAG2RgYxfw2f4A7:qYk/uDHn9rpgTjeLMxfw2wA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617344377, "uuid": "0c15c3a4-9ff2-4e98-894f-9eebf2dff95c", "value": 498204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617344377, "uuid": "83c02a79-f50b-4da7-ae81-ab1e28a21c92", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617344377, "uuid": "293f1771-42a5-4012-8e2c-7133ab5514a6", "value": "bank receipt.pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87f81d3-93a4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617362097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362097, "uuid": "83b8aae9-a313-4197-bf85-f4ecd2bb398b", "comment": "Malware payload", "value": "7bd86e4f755c4ee09e713ffdbde06e90", "object_relation": "md5", "Tag": [ { "name": "103.114.107.184", "colour": "#1DFC7C", "exportable": true, "hide_tag": false }, { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362097, "uuid": "1606de49-d79d-40ed-995a-1e7b72e671df", "comment": "Malware payload", "value": "34741598fab56c893a09868d7b922bc043e29fba4e5943df1f3b2c480da22b0d", "object_relation": "sha256", "Tag": [ { "name": "103.114.107.184", "colour": "#1DFC7C", "exportable": true, "hide_tag": false }, { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362097, "uuid": "e6f457f1-b41a-4f28-a461-414f076414e8", "comment": "Malware payload", "value": "d768457e9885a38c910b07d2186d0a9a46c20573", "object_relation": "sha1", "Tag": [ { "name": "103.114.107.184", "colour": "#1DFC7C", "exportable": true, "hide_tag": false }, { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362097, "uuid": "73dc91b0-e6fa-4c12-9ef7-00e522b18f70", "comment": "Malware payload", "value": "802e689e44f7792969de24ae36d6c184aa2dcd053d819d0aeed3f15f622b17f1c7ffe97b9644b76288dc288adc40d016", "object_relation": "sha3-384", "Tag": [ { "name": "103.114.107.184", "colour": "#1DFC7C", "exportable": true, "hide_tag": false }, { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362097, "uuid": "69e75dbf-d0c2-4e7d-9c10-b2ca9bbf94bc", "value": "7C1533AFDB4F3F49C052CCBD5FD84643995213EAAED546C42ABD0D9C802902C1627AFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362097, "uuid": "dd83859c-0774-4efb-8ffb-7485e2bd7e8d", "value": "24576:Ektp1DePUnA8hT0AlYzXdMy7n7Qxtl0gB3k3:1tecrVzlYzp7sggFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617362097, "uuid": "636f7169-6b52-4c88-8101-b707bcffb2fb", "value": 881173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617362097, "uuid": "c516ff2c-2cc2-4105-8663-1aa5b182dd28", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362097, "uuid": "04b5446a-1147-4586-87ea-a2b5119d3ea7", "value": "SKBMT 29 JAN 2020 at 1.70_BB3243_PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75302cf-939b-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617358337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358337, "uuid": "904e4a99-1b5e-4ddf-a42a-87b31fd54981", "comment": "Malware payload (IcedID)", "value": "ab37342ca883a24bc32f896f3e90236b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358337, "uuid": "f5ba52d2-6605-4564-b18b-3a68c2a769df", "comment": "Malware payload (IcedID)", "value": "34f79afd74ff0d330fd7f0c4da8397e9b6572a62b8954c9032ddad98e3dd5d33", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358337, "uuid": "0134547a-2378-47d6-8d4f-bb4715a3fbba", "comment": "Malware payload (IcedID)", "value": "af4b0d0a031fe8876182727903d0284211293937", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358337, "uuid": "8e109c60-95d4-43ce-902a-6b0ec061afc7", "comment": "Malware payload (IcedID)", "value": "f2b50058dd75e603d2c80fef91abd4a51364e1feaeeba3cfa5fda6441008376045bfb92de8d951e9f5297a8f7862cfaa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358337, "uuid": "133b6239-c001-4df2-aae2-cbf4bae92118", "value": "99C3298D6B907CA1C0FDBD34E3A19698821EFF309A4F47B794C5AB79C0AB5409623749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358337, "uuid": "8f7a71be-3cde-4432-90c3-ad329d8681dd", "value": "eb10ff98c4adb7472a591c82bd2ff673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358337, "uuid": "5acd8388-31aa-4272-a789-729bd5bf9686", "value": "1536:fmXIFRBSvf0EW6SL504jXnk1Nzva2Xj3108/l:dbafVsL504jXk1RvlXJdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617358337, "uuid": "605af784-5f89-49e6-a706-b63604741ebf", "value": 121498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617358337, "uuid": "a56f8cee-91ff-4e98-b064-b128c770be1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358337, "uuid": "814c97a5-c576-4f83-a2f1-c559c6e8381f", "value": "0204_1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4525a1a1-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617386412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386412, "uuid": "8e090724-dff6-46a2-bd30-15778c7fd171", "comment": "Malware payload (IcedID)", "value": "d3ad1f829b8a289ea6bedb0f8302c2cf", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386412, "uuid": "52358280-b4be-4e12-88ef-0241f7a71a0f", "comment": "Malware payload (IcedID)", "value": "34f9ddbf401369769f4081a9c1654d0a59b64ff2b2ca1656a0b6b2e62fd0d248", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386412, "uuid": "ed92b473-4a31-4db0-b16d-bcd27e956e20", "comment": "Malware payload (IcedID)", "value": "f7fe792c69aad0eaca8bbf7cacaa7485c391c547", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386412, "uuid": "f6e2e54d-5a59-415a-80a0-6c56244f6dd7", "comment": "Malware payload (IcedID)", "value": "46e6842b12d498e7030a764a5a273fda852e01197114112158a557f22c88cafbfefef609b1c8d2cb0e4742d095c870cd", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386412, "uuid": "32a67048-ccfa-4313-80c6-3b1f622f18bd", "value": "4404123CD0274C58C2E5447BD858C246AC6A2427ADF8A5ED668CB994EA137F30F7FB44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386412, "uuid": "c3f3c15d-b4cb-44a7-853a-bd8345564559", "value": "3072:fXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGDKJj:/E5SDvbXAyHbVt15wTQD0KJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386412, "uuid": "96ec85e1-26b9-4820-92ce-20da4fc507c3", "value": 176993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386412, "uuid": "704cbda0-b617-46d0-b0f5-348b0974d33e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386412, "uuid": "8385cd83-0dd1-4a75-981f-5a1f6cae0007", "value": "9497306271-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b5b065-93b2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617368075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368075, "uuid": "dc7e08b9-d578-44ad-820a-9a6367fc9db4", "comment": "Malware payload (Dridex)", "value": "273d7a7ede4993ffe2d9520efea0854d", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368075, "uuid": "f855ab6f-ca74-4712-b390-26699a63139d", "comment": "Malware payload (Dridex)", "value": "350a345f3933005f784448e0fda190eb61911bf732e768857a38ae7894664820", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368075, "uuid": "83e993c5-7134-4317-8bfd-46f99e56e8d0", "comment": "Malware payload (Dridex)", "value": "b1d1ab217a080296fb48358e7076ab2176e65056", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368075, "uuid": "ea4fd259-6c29-4c8a-93a1-e3953e311009", "comment": "Malware payload (Dridex)", "value": "6a300d9c763b3ce07961039d5379c820be543ed08dda20743499985b64ed24372bc01d776f47639c936fc4b1ef3ea297", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368075, "uuid": "5eb2fb4d-565b-4970-b752-74a13cd3476f", "value": "1314BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368075, "uuid": "069bf27c-2c0a-4827-adf8-49dc53236b14", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368075, "uuid": "4eb58b90-b642-44b8-9308-a175f37b23d6", "value": "3072:2opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:JpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617368075, "uuid": "0da9c4bb-4079-4fd3-a19a-5fd258e981be", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617368075, "uuid": "9f59aed1-da46-419c-b454-a5fcd556162d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368075, "uuid": "f659a173-5bd7-46ac-9e38-e31070ccc366", "value": "350a345f3933005f784448e0fda190eb61911bf732e768857a38ae7894664820", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a3a48b-93db-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617385738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617385738, "uuid": "b28d5cf1-135f-474d-9a52-85a6dd623a51", "comment": "Malware payload (Dridex)", "value": "ba1445104ca99cec48b2b083f87937be", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617385738, "uuid": "bb5c3552-2222-4240-b3ba-dbf31f0b9858", "comment": "Malware payload (Dridex)", "value": "35aaf54e51b3f1381169cfe4973cd3487039ed31b4d0096c0de0d7f0d05e24ec", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617385738, "uuid": "3b620532-ce9e-4f85-b4ca-59059cd255e4", "comment": "Malware payload (Dridex)", "value": "30e4cf3a665e397bc4ee4191685a12218ad97356", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617385738, "uuid": "fde8777e-f84c-4ec4-a416-67b863c31f78", "comment": "Malware payload (Dridex)", "value": "d797e4e2a13126b853b80fca9a010f3b866960b5d8fc088efe36636fb21293e365597d66ebd676cc5f22a3083357f706", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617385738, "uuid": "00140ca9-aafd-4c57-9b19-dfee702dd134", "value": "A5248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617385738, "uuid": "49ea48bb-ab1b-49d5-8de7-d913c5c7ce1c", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617385738, "uuid": "ec756826-0683-46b2-a1a5-033df16910fe", "value": "3072:H6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:HoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617385738, "uuid": "962d549f-7412-42a6-b80f-955f7b425bf8", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617385738, "uuid": "b3d99fb7-245c-43cd-a5fb-0082bc3387d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617385738, "uuid": "a5655b3b-2c9d-4bfb-a815-18cfa7ee10e8", "value": "35aaf54e51b3f1381169cfe4973cd3487039ed31b4d0096c0de0d7f0d05e24ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04be34b9-93ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617394035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617394035, "uuid": "076bcd5e-d401-4f8b-915b-d67257506887", "comment": "Malware payload (Dridex)", "value": "cf8ab9b77616ad6e44c5134dad92afbb", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617394035, "uuid": "234ebf6f-4e46-4bf0-b8f6-776901e7b182", "comment": "Malware payload (Dridex)", "value": "35b978853440c53303878f02d855da523c3154b72fd1ed5107ad2e3656a353b4", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617394035, "uuid": "99804f53-7a12-4661-8773-fe0172693eea", "comment": "Malware payload (Dridex)", "value": "735311ff19f8af80f712009e61f8d2ca0486c879", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617394035, "uuid": "8b7b8242-6bee-42dc-8f1a-0876a71ff6e7", "comment": "Malware payload (Dridex)", "value": "8aacd50931eb50355658e9348fa8fd9b858d4e6c46da54a685e0476e7d30ac438ebe0e4c75834b68af808036a1dd58bb", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617394035, "uuid": "c0ad8456-feb6-4cf5-b7f5-cd4d3ebaf57b", "value": "C414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617394035, "uuid": "bbd92f16-7111-4cf8-891b-5671cc5d6f0d", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617394035, "uuid": "a18bff35-0815-4399-8fcd-aa752c4fe700", "value": "3072:Iopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:/pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617394035, "uuid": "5dacb212-a964-4da2-ba54-c1e5125c7f55", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617394035, "uuid": "8a578f2e-e492-4187-8254-f540cc25a6be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617394035, "uuid": "2cf48440-c99f-4956-b764-82ae15534b1c", "value": "35b978853440c53303878f02d855da523c3154b72fd1ed5107ad2e3656a353b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4d25d4-9380-11eb-abe1-42010a9c0039", "comment": "Malware payload (gozi)", "timestamp": 1617346727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346727, "uuid": "b1c08d80-30e3-4fce-9b85-162e6bdf131c", "comment": "Malware payload (gozi)", "value": "ff376d3c109c043d131cb7ce162ccf72", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346727, "uuid": "e6c2a308-2af0-41f7-aaef-ed623aa4cc0f", "comment": "Malware payload (gozi)", "value": "365af42605eb77a31bbbc9ae74257ee7bb3ec5ede09cdd084c9653980e93bfd5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346727, "uuid": "6eb44dfa-da8a-41db-8245-a779fe71ede0", "comment": "Malware payload (gozi)", "value": "91354a623c09add845d08f4f56896f783f0316b9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346727, "uuid": "9140f351-acb5-4490-acd1-5e72c24c9d7a", "comment": "Malware payload (gozi)", "value": "76e0f6967e2941bd929ac017690ca5b03b8e85e82a6c0ddbd7906cb1d57dd2b2bca0293a442d116afd1f7d1a9c306c9e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346727, "uuid": "8f978b9f-3d2c-4121-bd81-c7d05480c2b5", "value": "1883F213DF54EB02F5A852BABE4727DCBF01242C99A775EF02400B4B7D283364A4E5AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346727, "uuid": "71eeb66f-d683-4d82-91d6-130ec5de32f1", "value": "1536:Q1f74wjcFSdH/MpFyY9ZXlk8qtZ0xaPgoy8+JmipkmvvtQSFBR0PfyI9LMRfWBAE:Q1zVNkpLZ1k8g05oyDJmipk4vykYARfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617346727, "uuid": "4317ac97-aaac-43e3-a0c5-70873ea0e6b6", "value": 82316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617346727, "uuid": "6120e523-7523-4573-924e-b7208466ac28", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346727, "uuid": "081477ef-3a3f-44ee-b21c-0bc868044eed", "value": "legiferare_04.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66f2cf7-939c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617358792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358792, "uuid": "6af2484d-3f58-497f-b468-89f75946fcfc", "comment": "Malware payload (Dridex)", "value": "44cfe61d35447c230ca803865dc197a5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358792, "uuid": "9b5a08f1-13c6-49a2-9d66-69fa80f4aa9b", "comment": "Malware payload (Dridex)", "value": "3671c96e37e3aff19f5420a79336e7bc1362cc49bc264d0fa21e816b4f4a90f5", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358792, "uuid": "dd7c394a-e127-45ec-b47c-a64f7d974d96", "comment": "Malware payload (Dridex)", "value": "0033e2030068516d6aebf1dd45c7b2b74a1b0098", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358792, "uuid": "b925520d-40ea-4f7d-b080-f02eded80176", "comment": "Malware payload (Dridex)", "value": "8dc8bb5b87a43e153b9edf6f8cf9f990dc25ac7498d5766afc7dd06284792521f8628acc8a02f8d9cb371f013d926e41", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358792, "uuid": "c2a20cef-a6c4-4fd5-af39-8043d7fdde9e", "value": "E414AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358792, "uuid": "26f4cda7-5f52-43aa-8279-1fabf6527d48", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358792, "uuid": "39f12d5d-fcfd-4fd5-890e-02ac0c6dd571", "value": "3072:e1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:2i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617358792, "uuid": "1714b6cd-6c38-41a9-a0c3-8b16a184c425", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617358792, "uuid": "f9db7192-fc77-4532-9209-136a98272807", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358792, "uuid": "548b1b64-2b78-4b2e-ae8c-91d04677229a", "value": "3671c96e37e3aff19f5420a79336e7bc1362cc49bc264d0fa21e816b4f4a90f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28150840-93e4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617389369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617389369, "uuid": "faa6f31a-d81d-45bd-b0fd-7ca04d771018", "comment": "Malware payload (Dridex)", "value": "83a5b0a2407e3836a1f06c335e3fff9c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617389369, "uuid": "ec80b83d-ff0d-4dda-a68c-006519dd872a", "comment": "Malware payload (Dridex)", "value": "36a4a358a56a4ec32581dd9ba96e3d3b1ad8229d1df30baa912622a1205226fa", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617389369, "uuid": "9e392b66-6f1f-4d36-b6ab-16b8493a43d2", "comment": "Malware payload (Dridex)", "value": "2dd93c7f14bd4b66079abae049d7240243f0faba", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617389369, "uuid": "e352647e-867f-40e8-aabb-db084ced03d6", "comment": "Malware payload (Dridex)", "value": "826b237525f85e59a4b465e95bf0cd74913502c68df78007e4d09ef8a13122424721275908f7a287f3bfeb71d6b607eb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617389369, "uuid": "2f16aed0-ea67-4c7f-8e24-aa136e537292", "value": "BE248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617389369, "uuid": "73955408-3207-4c03-9328-dbbb62d690aa", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617389369, "uuid": "78a59b63-8abb-4e25-8d83-71380401e32a", "value": "3072:s6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:soMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617389369, "uuid": "fc6847c8-b5a3-4456-9478-ac24e841e528", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617389369, "uuid": "553f3b26-cb7e-4bea-aa86-8a6d2efa0f6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617389369, "uuid": "4d97bf63-8ea9-4df3-8706-01fa60287c81", "value": "36a4a358a56a4ec32581dd9ba96e3d3b1ad8229d1df30baa912622a1205226fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "265a60ab-93d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Adwind)", "timestamp": 1617381636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381636, "uuid": "6672a982-90d3-418f-94b0-9d794984095f", "comment": "Malware payload (Adwind)", "value": "d5ad825afa65f3453edd942b4cd7e153", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381636, "uuid": "654d4e79-4848-4a48-b799-9c01a142271a", "comment": "Malware payload (Adwind)", "value": "36df8245bc306fcdbdd7552aeb63503ae2f5ccbad2a971c5bf0c1d51bfc700cb", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381636, "uuid": "2352179e-76e0-4525-94b9-6e0a93a22cf9", "comment": "Malware payload (Adwind)", "value": "76b43a160a28628a6d82bd62efb0478e112e6c8f", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381636, "uuid": "626be4e7-39f3-4cc3-891a-b2b353da00be", "comment": "Malware payload (Adwind)", "value": "6dd010c17f5227629df36027ae46c026a3216f0cc9c530e16484969ab552eb45e256f0bfc6b9e5898367f2c2f0cf0021", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381636, "uuid": "55ad30b2-2eac-4293-9a3a-bd0fd7c8bdc9", "value": "A8D423322C577121E5EEBA5ED96C8FA0EA1704204C3E7051EBB578AF7DDD184A3B28D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381636, "uuid": "a79ba16f-53d4-4ef1-ba98-d64c8f076ed6", "value": "12288:PLNWwdztXQgTNyMV1jakDPwN/WVj8dBzuEt99EoW1l7CWnjRF76d+Z/:j3bJNyMV1jdi20zZ9nW19CWnjjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617381636, "uuid": "fd839cad-e4c8-4eb4-88f6-f697ea8b8ee1", "value": 645128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617381636, "uuid": "05242288-d2c8-40c8-b4ff-f74111d7fc0e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381636, "uuid": "3fc110f3-f3ae-4ebf-bff7-b99b687e3057", "value": "PO SKP 149684.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4570828-9396-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617356131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356131, "uuid": "e745f4ea-8089-49ff-9493-1dbb0ab857c4", "comment": "Malware payload (Dridex)", "value": "7cce44c100d3963608a0fb461cb88054", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356131, "uuid": "c3fa98f3-648a-4f0e-bdb8-e9ad345f07f7", "comment": "Malware payload (Dridex)", "value": "36e0b9c0639713b7f77f96c61b6e3de98624d8feead0c15f45848775c83efd8d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356131, "uuid": "c880adac-a84e-4176-86ed-f76349475c79", "comment": "Malware payload (Dridex)", "value": "a5d1fbddf2eb4a52973a8ab022407ee72aebf9cc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356131, "uuid": "5d22fb2e-65c0-433d-a6f3-97beae9d9577", "comment": "Malware payload (Dridex)", "value": "a89009b3184b35594f3045c1a7672b5f031ddb2ddd7ed0bafbcc2a387fd2c044a9f4078f163c20f683d3d3251a406bd9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356131, "uuid": "75a612f5-9b7b-42c3-b94b-ef931eb1c8ba", "value": "F714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356131, "uuid": "771611ee-13ec-4530-91b0-ee899eef5ca1", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356131, "uuid": "5e66198f-2d1e-4efb-adbc-7b2087809b10", "value": "3072:Yopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:PpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617356131, "uuid": "cc695dac-fafb-4f79-aee7-89ea86cdd452", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617356131, "uuid": "fc38818d-9513-4663-9d8e-45b93292704c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356131, "uuid": "85b09083-eec5-450e-b504-a530dc04f17f", "value": "7cce44c100d3963608a0fb461cb88054.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec29b5a-9406-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617404306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617404306, "uuid": "7daef8f4-7293-42c4-8654-921b421081eb", "comment": "Malware payload (Dridex)", "value": "a71e2e6961593bfc3b7c460c15959902", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617404306, "uuid": "f2af3071-475e-4736-975c-ac105d6cdaf0", "comment": "Malware payload (Dridex)", "value": "37b5559bc1210e4b6eacaf416904b6c918543f6544684411d3e3789d2b707586", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617404306, "uuid": "24fb12ab-d016-4a3c-b7b5-c8c5e36952bf", "comment": "Malware payload (Dridex)", "value": "142f024ad098e074bb5c49d1910c8c59c347edd1", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617404306, "uuid": "1b6afd15-f18e-4c19-8bb1-a35b48785bef", "comment": "Malware payload (Dridex)", "value": "c4975d3d420c00577cb387f8a658d771d09b3903b6b43bba386fe65c0b6cd75351ca0a1de7f72316b4c498f6153aa92e", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617404306, "uuid": "ef99e9cf-3074-4334-9590-99871076720c", "value": "B114BE4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617404306, "uuid": "12a92a68-e5e7-4735-a4e5-65a8e2f8f279", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617404306, "uuid": "121d1dd5-f55d-466f-b0c9-bf340792ace0", "value": "3072:oopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:fpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617404306, "uuid": "7a55a031-5f97-4c0b-b886-645c22f797d7", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617404306, "uuid": "8dd4cce1-3de1-42d5-973f-11524fc6edf4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617404306, "uuid": "5ba1016c-251d-4b37-b075-cdbe39323a1e", "value": "37b5559bc1210e4b6eacaf416904b6c918543f6544684411d3e3789d2b707586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18686c5d-93de-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617386766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386766, "uuid": "2e46482b-1769-4c97-99fc-3e76da2afb2c", "comment": "Malware payload (RemcosRAT)", "value": "3874058a99ff3e345dc6f87cee47d284", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386766, "uuid": "bd4c2865-4ddd-4c4e-8b42-c58b5620ee73", "comment": "Malware payload (RemcosRAT)", "value": "37bce33693a358d3ed3021325869fb33d1147efeb6a7636b35d9f22ce68df8d7", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386766, "uuid": "3322e40c-af90-4037-b895-3ca3c2cb5da5", "comment": "Malware payload (RemcosRAT)", "value": "fd38d15217c7e6fe25581ffb37b6b7e479e8a82d", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386766, "uuid": "626537b4-3085-49c7-9a76-ebe31b149cd1", "comment": "Malware payload (RemcosRAT)", "value": "eebe492c19049e9a8c7fb003b079f70d93438d4d5c615d21836d0516babc55eba0505df31684a69308d28115a16acada", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386766, "uuid": "cc288824-edd4-4425-96ac-567c09c7bb0c", "value": "D645E012B70841F7C0A90B3299575B36AEBF29313B765A0AA7905D3C7D723C26F64F84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386766, "uuid": "21ab6174-41c8-4322-8276-f6f7ced5a8a6", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386766, "uuid": "e19ac1e0-eba7-41c2-a7b8-0e97acc58e71", "value": "12288:UQnk3GDYKGcblFsVRB8EW+xbwI8aXGMWxJPgH7GN3oERUcm6a7f+3pF7VC6+98px:oAOcZkBLWKw0XiJPkY3ooUNdunr+qpsA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386766, "uuid": "ea2ec881-3ea4-4625-a94e-5eb5415f71e0", "value": 1244215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386766, "uuid": "d592af3f-58cb-4093-ba6e-0a3701559308", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386766, "uuid": "79493136-7f23-40b5-84f2-6e67d72ad131", "value": "Waybill Doc_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6973e645-93a3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617361562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361562, "uuid": "6dbb0495-6b06-4564-b5bc-ce54b5771a4e", "comment": "Malware payload (IcedID)", "value": "e09149f5419c9de9dce1e5f79db8aa61", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361562, "uuid": "0cd914d4-bb8f-4451-aa50-9a954617af80", "comment": "Malware payload (IcedID)", "value": "38946bb4b35e39c3edbf13898554e9e5643604fdf3a2d3376e464f6d89f9426d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361562, "uuid": "4c46445a-fa28-4718-99f5-3ca3b4237769", "comment": "Malware payload (IcedID)", "value": "b000ac479e8e60e75db150ef477e731c7d7f85f4", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361562, "uuid": "b12831a6-9b2c-48da-ae80-2240a8a35d9a", "comment": "Malware payload (IcedID)", "value": "b05fc47e8be350565dca8a17ddff139abbf79f1c73d2fc06091b09f9a8a6b7d0c3970a62109c0a52f5aa9eee24428e48", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361562, "uuid": "1df9244b-1c5b-445d-b55a-eff4641091ce", "value": "5A939DEDE907F4D2CA158F7C4D12758920BAC4A6265FF007709A622F5D22F6C095F2AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361562, "uuid": "d9db2d28-7605-44fa-9623-0344c22d757c", "value": "1536:oB2xe0FM42S2hawdIVseTSV7SaTe8NDUYl+LrHtlmuzx2ofDg:e2bMcMpnSaTDDFysE2obg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617361562, "uuid": "bcdf5f42-b826-4aa2-ade1-a51aca3cb8a6", "value": 94801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617361562, "uuid": "c088b78e-28e7-49d9-abe2-cfe50d4b52d8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361562, "uuid": "f6e32c86-898d-460b-88e4-fed99e87641b", "value": "documents-575751901.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71226ac0-93d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617384338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384338, "uuid": "b5285f90-cfda-48fc-98a1-e384e21bd2d9", "comment": "Malware payload (IcedID)", "value": "56043e272dd379396ec97a71bd9082d4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384338, "uuid": "67f674aa-c6c7-44fa-a6e7-200d903409c3", "comment": "Malware payload (IcedID)", "value": "3a939d5f1bfd54e904e9d69c05eafb6007af8b80334cc5e8764c253fcaa1982a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384338, "uuid": "667d13c1-ab23-485f-ba95-f8383226522d", "comment": "Malware payload (IcedID)", "value": "6342cb93edd36045726e9b253f7c9e54f44efec7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384338, "uuid": "1173a3f1-05ff-49cf-bcc7-be0c5ae8c7f6", "comment": "Malware payload (IcedID)", "value": "ffb5501e43ec38a4de2d2ac7ec1d8c4b6216b95e05e5cb767a10d221dce26df41f2f3dc110b6f415216a4bbddc472ee3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384338, "uuid": "1cc60b05-c489-4563-b46d-44721f78fa09", "value": "88530A8947503C91C0FEBD34F3A69A58931EFB30AA8F47B794C46BBAC47B5409723619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384338, "uuid": "52eb71c3-9c20-4613-98a9-1db9d88e502b", "value": "eb10ff98c4adb7472a591c82bd2ff673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384338, "uuid": "b5aef7fa-0685-4f6a-b27f-77c9d7e795ca", "value": "1536:caCAzXz8T6rLXah8lI+Idu+B3XbuF6dRiF:n/gTkXayetu+BbuUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617384338, "uuid": "5377a4f1-192d-4455-8b02-8039d8e84e66", "value": 65568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617384338, "uuid": "61b04311-ca06-48cd-b450-50261e6b8ae3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384338, "uuid": "ce32dd62-2a3e-4749-97b5-782439a2b6e2", "value": "3a939d5f1bfd54e904e9d69c05eafb6007af8b80334cc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d766f55e-936b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617337694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617337694, "uuid": "10766245-7abf-42a1-81be-4dfb74c8a909", "comment": "Malware payload (Dridex)", "value": "a71dddb9f03a94a9f7b96b0c1d3870fb", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617337694, "uuid": "5924a312-5a98-40c9-a98d-f015bcef7b36", "comment": "Malware payload (Dridex)", "value": "3bc16ecee813c921272f2201997be302dfd251547cdba755bbf3e8cddbe8c669", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617337694, "uuid": "e05e4797-f347-47ca-9fc1-55c56f51c83d", "comment": "Malware payload (Dridex)", "value": "e8f10c4530ec9d033ada6db20e86b848bc424443", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617337694, "uuid": "1275bc91-b0fd-4fed-bca3-80760bf62743", "comment": "Malware payload (Dridex)", "value": "ba41418d38fd62c5e0ce9213fe22d2d29b6a52d0fb51f820a474da79c67ee178206d5e4d29ee6bc4a83a547b9ce96611", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617337694, "uuid": "72959d40-d694-482a-8301-284083d54b42", "value": "3E14BE4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617337694, "uuid": "75410f6a-3595-4aa2-a133-e9a01cf80140", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617337694, "uuid": "4455860c-a65d-4a39-b921-424fc3155e14", "value": "3072:4opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:vpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617337694, "uuid": "7f3a0af5-0ce8-4013-a0ec-cc0930679cfa", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617337694, "uuid": "c237ebb5-a7aa-402e-8c6d-8f20db332250", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617337694, "uuid": "20c8fae6-9abc-4fa3-ba74-00b4f1c5156b", "value": "3bc16ecee813c921272f2201997be302dfd251547cdba755bbf3e8cddbe8c669", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a338d7ca-936e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617338895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617338895, "uuid": "0aaf4c06-c1c1-4be3-8fd8-63371bce6128", "comment": "Malware payload (Dridex)", "value": "fae3f9c2c4de1f545a57c350de286a33", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617338895, "uuid": "bed5ddbe-e0e1-4cac-b8ea-57c13e28cb7c", "comment": "Malware payload (Dridex)", "value": "3e4119514c9c633c7c5307c82003b404fce6946abedc6349aa7ce7f6f6b7ced0", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617338895, "uuid": "7a17ab18-4471-49e0-a5b9-fad5714f7c63", "comment": "Malware payload (Dridex)", "value": "bdbf5247837b0bcfdc73c66e239c7f3c458d9d7c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617338895, "uuid": "7abf7800-8a99-4e46-b805-5c9bd852f490", "comment": "Malware payload (Dridex)", "value": "3c41ef567f4ce6d49e152bdf25482f2f378c50d30bfc67e578bd87c5667dc2880865834a12bcc6a5440996e29147805e", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617338895, "uuid": "f97b19b2-505d-4dd8-b3bd-6be0ad858ffb", "value": "0C14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617338895, "uuid": "83ce8c06-83ce-429b-8a0d-a57523b6d648", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617338895, "uuid": "0cff0a70-10d3-4691-bd06-156a1231eb21", "value": "3072:bopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:spjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617338895, "uuid": "e653dfaf-53fe-4dc7-9326-b972ce3bfb84", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617338895, "uuid": "773292ea-a9ad-48a2-979d-f26cd3119056", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617338895, "uuid": "19f95fb4-e3b8-4c43-843e-590376d1c38d", "value": "3e4119514c9c633c7c5307c82003b404fce6946abedc6349aa7ce7f6f6b7ced0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec4f894-9379-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617343773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617343773, "uuid": "24426ff6-11d7-40a6-b994-9276c295bb20", "comment": "Malware payload (Dridex)", "value": "ed70476b8a3f521c53985c67ba490f5a", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617343773, "uuid": "890f56b0-791b-46fd-a2c5-022dca5eea8d", "comment": "Malware payload (Dridex)", "value": "3f6ca6910762218ea987250d82054bf6982dc29edc4e33a0138627571d8fdd90", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617343773, "uuid": "ad667796-c353-42ca-b106-649dd5e3c2e3", "comment": "Malware payload (Dridex)", "value": "e553a80fba4cf35d4572c9cceef5a73bf0ca9f9f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617343773, "uuid": "944750ed-847e-4fb4-8370-0acc9cdd7803", "comment": "Malware payload (Dridex)", "value": "130a59c5a490b892132ffa74e4794622a2328a80db83992576c5a2476d55fd42db566c82c09daab835b50c949d4745bc", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617343773, "uuid": "f68cb9c6-6d14-4ddb-9956-7bca1aff69ca", "value": "4714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617343773, "uuid": "a48d215b-81be-4176-81eb-e278e6ef5db8", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617343773, "uuid": "2aa7faf4-df5c-46af-9056-7cdcfb0be6f7", "value": "3072:lopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:KpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617343773, "uuid": "bd4d5db4-7284-464b-a265-018985f42bfb", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617343773, "uuid": "50506469-53da-4c46-82d9-29d6fb77ce0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617343773, "uuid": "bb0a5094-9acc-44d6-9417-ae57e65a3cfb", "value": "3f6ca6910762218ea987250d82054bf6982dc29edc4e33a0138627571d8fdd90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a3fbad-9399-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617357482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357482, "uuid": "02ee611f-aa56-4afb-ba69-cb0d4124d522", "comment": "Malware payload (NanoCore)", "value": "5918ac55943ed09458e4b997e993ae40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357482, "uuid": "da265d3c-cd89-4c63-b074-3d5c46851746", "comment": "Malware payload (NanoCore)", "value": "42395fe0a9834f127984ce1ed171f4b07ed9321b6c066ec3843bbfe180c74e72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357482, "uuid": "d6a5999e-6eb1-4b94-b789-4b9b16255e09", "comment": "Malware payload (NanoCore)", "value": "3922bc9bea781a20a69b9858fbd05b2612a43dd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357482, "uuid": "ae83b5b2-498e-482b-b1bb-4379a8bbdde8", "comment": "Malware payload (NanoCore)", "value": "de665f0d452b71747a387dde8277643af668f9f7c01347990118898a9c0a8fefee42b9f1bcf107a961938da08d3a04a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357482, "uuid": "95a80d38-d04e-4117-a353-daf1b91363b7", "value": "9714CF1677A84A2FE2DE8579711252179378C2E7A9C3F3DE28D851B79F223E10A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357482, "uuid": "5ef40209-a2b7-4e2b-8a4b-5ad5e95fafd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357482, "uuid": "b8ca7829-9c2c-4492-bce6-2abdb9948770", "value": "6144:gLV6Bta6dtJmakIM5hzxAnuBlMvBZORkV:gLV6Btpmk0xAIFkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617357482, "uuid": "8fe95941-03c8-4488-b754-ae13e4038a15", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617357482, "uuid": "0142a48c-3b47-467b-9fd1-40d14d19cb85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357482, "uuid": "ea42049a-a421-4690-ab49-86a76a015770", "value": "5918AC55943ED09458E4B997E993AE40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b4e555-93e6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617390404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617390404, "uuid": "04e24b99-2fb0-498f-9bc4-d04f024c046e", "comment": "Malware payload (Dridex)", "value": "e235d172ad39399f1c6884fc9384a5bd", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617390404, "uuid": "0effd082-9681-49d4-b14b-a88a4df7288e", "comment": "Malware payload (Dridex)", "value": "42bdc3b203fffcadc4d0b4be0af7b72507b8b680670a7ad09465471fa622bc8d", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617390404, "uuid": "6550bc5f-0528-4ebd-a891-4252f854e499", "comment": "Malware payload (Dridex)", "value": "60d5db8782f7da823009795aa22141e6b4c71664", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617390404, "uuid": "7f282218-c016-41f6-a460-20b01927d962", "comment": "Malware payload (Dridex)", "value": "6a64a64e380a9e081bb3561467fac04e70500d69e8346d9ad228869fda4c6168a97d45b6b6b47b66184bf4e5d6cd04d2", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617390404, "uuid": "bc7f92cf-abb3-4bac-b284-928f222fd1c5", "value": "1714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617390404, "uuid": "8675470a-9b3f-4335-93fe-c84d367df2cc", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617390404, "uuid": "27cb0974-92d8-4bd4-979a-2c3ed104966b", "value": "3072:Copj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:VpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617390404, "uuid": "1e7046d6-148d-461a-b997-307a82c8593c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617390404, "uuid": "262a4663-dcce-488c-aab6-f3a6772553fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617390404, "uuid": "3e3bfc0b-f810-44d5-b0d3-73404fcfa9f1", "value": "42bdc3b203fffcadc4d0b4be0af7b72507b8b680670a7ad09465471fa622bc8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7dd728-93b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617370209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617370209, "uuid": "bb141754-25f4-4186-ba95-7c5b5b4c73e5", "comment": "Malware payload (Dridex)", "value": "59caab52e5966ce9f4bee136088394c0", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617370209, "uuid": "57bdd5d0-aa1d-47f5-a551-f5fab5ad8399", "comment": "Malware payload (Dridex)", "value": "440b50ff2c63ba2297ce1814c5c406c66df49f785a2a70b13dd99d5afb9f2ad4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617370209, "uuid": "b558e35c-38d6-4f07-a893-5d26dddf9f0e", "comment": "Malware payload (Dridex)", "value": "313c65d48de15491c1114fae569eb5aa219b92b0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617370209, "uuid": "e1bc9003-27d3-49d7-b20a-2c1556d0bd19", "comment": "Malware payload (Dridex)", "value": "2f917b1b50dccfb38de9b5cc6f6df0cf19eb1340637de07f2ddbbdb4a10bb1f7b83c6966909edae1b29a92be92febf2d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617370209, "uuid": "d6f9b014-b846-4303-a8a3-b28930293aa7", "value": "CB14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617370209, "uuid": "3381cbd1-40bb-4090-9004-b8fbdacb6b34", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617370209, "uuid": "acbc2b23-8241-4908-83c1-acfad9b1685f", "value": "3072:z1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:hi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617370209, "uuid": "1ea795bb-98cf-4d03-b31f-787e11f38483", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617370209, "uuid": "f8e7656a-a2b8-4a8f-a8ed-d8720b94e372", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617370209, "uuid": "746308bb-a78c-4bc9-a6a4-18f78728327c", "value": "440b50ff2c63ba2297ce1814c5c406c66df49f785a2a70b13dd99d5afb9f2ad4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "635dd9dd-937c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617344801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617344801, "uuid": "1aefa942-746c-4a64-99f4-337fe72d8120", "comment": "Malware payload (Loki)", "value": "abebd0ed6fd6c71bf1593efc5eb3312f", "object_relation": "md5", "Tag": [ { "name": "CZE", "colour": "#9FD7C1", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617344801, "uuid": "72153922-5438-4d95-b66c-d123ba15050c", "comment": "Malware payload (Loki)", "value": "44609be274ceb47badbb35cb9b9bd861a2ca4a0aec9c8348fbabac39816ed73f", "object_relation": "sha256", "Tag": [ { "name": "CZE", "colour": "#9FD7C1", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617344801, "uuid": "19cb67df-c2b5-4ae0-8fb3-b8d44fd8b4ac", "comment": "Malware payload (Loki)", "value": "c42533786aeda835eb77ecdb7eb8aaa0bceb0b85", "object_relation": "sha1", "Tag": [ { "name": "CZE", "colour": "#9FD7C1", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617344801, "uuid": "28614a4e-6d93-4d08-b72c-1e7fe4dd9a61", "comment": "Malware payload (Loki)", "value": "a4f041b2bc652070f84aa553c119694dd8587a55c04ebb3e5a8afd1bcd34fe5dadbc51f3ad089c0adbe460b204d92101", "object_relation": "sha3-384", "Tag": [ { "name": "CZE", "colour": "#9FD7C1", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617344801, "uuid": "e320324b-9dee-428f-a428-0d30252ba79f", "value": "B7F4C5B444C918A1E2D7C4917DEEFD6011B6F5D7CEE68D6003BCD2720E69B667E83A08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617344801, "uuid": "057b42b9-832c-46e0-950e-3bcc3db2f4d7", "value": "12288:IDd5jAiI675jJ65jAiI6R5jJb5jAiI6D5jJc5jAiI6k5jJg:ID3jAivlj6jAivDjHjAivtjAjAivGjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617344801, "uuid": "899745f8-c554-4488-bab3-b89bced15240", "value": 772969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617344801, "uuid": "0c8f22f7-f9cb-4ebc-9946-378453f1a4a2", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617344801, "uuid": "6d1782ed-2614-4ca6-a4fc-3eb4d5625ab5", "value": "Zadost o cenovou nabidku.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca896ae-93ab-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617365137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617365137, "uuid": "e8cd1492-6965-4834-a9d0-17b101d3f865", "comment": "Malware payload", "value": "88a4c83b2a01089260738a15a937ea04", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617365137, "uuid": "a12ac345-aff1-44a7-86c4-64b56976bf66", "comment": "Malware payload", "value": "4460c235618656a82b92cb654eb6ba2eb676894c57e2ebe032601a7fbd9aa8aa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617365137, "uuid": "115c8a20-eda1-4227-923d-ca508843b7f1", "comment": "Malware payload", "value": "5214e4016553a9f6e157b3b2ed3f1a6f3de2a164", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617365137, "uuid": "c0fee2dd-fa9c-46ba-a07c-2ba047d1c588", "comment": "Malware payload", "value": "4d23c9fdc40e2fd7cdcab5a7e5852e28c264dc40ff4c78837f3798fa49d189b224702b431561903c7707157646e868be", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617365137, "uuid": "e6e780c7-2020-4ac5-9379-9b607d16a66d", "value": "DA03B30136A5D11ADA9909394CDBDBFE76303C01ED42925771C4BB2FAD3E781DF22A68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617365137, "uuid": "1ae85de7-5d66-4be1-8eea-c04f4e0b3b5c", "value": "768:QTvTV5B1iuNa4jt9nZPQYzdb18kxGN2Rszyp19yM53oL/VpyYcncvk7Kqw9kt6/X:iDFbti+HLbnBxuCRs15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617365137, "uuid": "79b4659e-d9a1-499d-8ce2-a11cfe7bdc6b", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617365137, "uuid": "638b1ee7-2d32-4cac-b57d-d61da89a347e", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617365137, "uuid": "7de6fa4c-8abd-4c0f-aca9-3fef269478b4", "value": "SecuriteInfo.com.VB.Trojan.Valyria.4146.23443.12767", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7420188d-93d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617381337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381337, "uuid": "671e5167-a74c-463c-9257-268e16c7b760", "comment": "Malware payload (Dridex)", "value": "d157eab41375becf5627b2ec1d6035ba", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381337, "uuid": "2fc22e27-6d9b-4c97-8427-29ae9fba53ab", "comment": "Malware payload (Dridex)", "value": "44b57201cf198e028af5908c30ba5c21f7ac0ae09bc67422801a5ba0304b465d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381337, "uuid": "d0fed3b0-959b-4ce5-81ff-3a7de7716e16", "comment": "Malware payload (Dridex)", "value": "2c340881511df3f17c42df0635c5234b5c5cefe2", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381337, "uuid": "d4077138-6960-4a63-9d3c-6c4f3eec10e4", "comment": "Malware payload (Dridex)", "value": "a7981c8b077d8f995d894980015e431c4c73bca91fd00690dcc1e6f90e3b85a18074bef090df600c200bedfa9e86901f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381337, "uuid": "2c27154d-10ed-4691-ad77-bbfe971d96c5", "value": "4514AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381337, "uuid": "41aa4ba0-befe-4f51-a194-278fbc97a1d4", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381337, "uuid": "8f9b75e1-1ee9-4ebf-a527-f3c67fed4db6", "value": "3072:Y1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Ei78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617381337, "uuid": "cb71f018-6fa1-4fe7-8ca2-fbc890bb8291", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617381337, "uuid": "1e233c6a-88eb-44b3-86a1-aded869d1666", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381337, "uuid": "b5c7245e-b1b5-4187-9409-e5269c49bb9f", "value": "44b57201cf198e028af5908c30ba5c21f7ac0ae09bc67422801a5ba0304b465d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4aa8b5-93bd-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617372655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617372655, "uuid": "53d809bc-b29c-40d7-8cbb-d6126c04b101", "comment": "Malware payload (njrat)", "value": "a6481acb35ff26be5cf01e3686553ef2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617372655, "uuid": "091fdf86-5d2c-4b74-a8ed-399130044e1e", "comment": "Malware payload (njrat)", "value": "44e86cc44a75bbaac5fc8b4e006f1dc86e2fc9f1440c6465ff3ab9b6de8d5760", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617372655, "uuid": "bc902c73-2b1e-4164-a80f-c1a5562fe9e4", "comment": "Malware payload (njrat)", "value": "c06c5445dd459ce02f991d7574faba3e29f7f0ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617372655, "uuid": "273c2a43-fd12-4236-b73b-869ff6dc7dff", "comment": "Malware payload (njrat)", "value": "05a2084f5ae36b6c2bdfa8f101cac6aa5900cc3623025ab48d33b066801ff0c40246207d75c8340051f4709df0e984a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617372655, "uuid": "94e1c11c-b04a-4173-816f-09cf1e4af033", "value": "C4E3B597BD80E18ACD3CC276A42ABE6846A3F4BB8477419574CF6B5FEDB36C40653900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617372655, "uuid": "8e25edd4-9017-4fbd-b3a8-126cdd3e7af6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617372655, "uuid": "9814a13f-03f4-4b4b-a5b5-3a891ff97d5d", "value": "3072:wRDk1Ay+yJX68oJVVVVPVVVeVVVPVVVSVVVdVVVyVVVdVVVVVVVXVVVDVVVcVVVF:8k163JVVVVPVVVeVVVPVVVSVVVdVVVyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617372655, "uuid": "21927f14-32f4-46b8-9d62-d462b7c1c718", "value": 152064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617372655, "uuid": "256b286e-a762-494f-8431-b523c57d2746", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617372655, "uuid": "ec424052-1a1d-4c1f-908a-fb68bc9dd0d9", "value": "a6481acb35ff26be5cf01e3686553ef2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c01d490-93d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617381162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381162, "uuid": "a0223dc6-71fe-4d90-a808-cf247c5bf46f", "comment": "Malware payload (Gozi)", "value": "4732d47c17eb55cda13aea170ac122fe", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381162, "uuid": "9805b10e-b550-434f-9f03-32e5275648ba", "comment": "Malware payload (Gozi)", "value": "4502918b2eb7a7ff6bc77a2d9878fae3b2389f30124d224ba92958ab13fdf39c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381162, "uuid": "e7905e91-7506-43cc-a8d2-3dc47c97d9f6", "comment": "Malware payload (Gozi)", "value": "8f982ae3c9f237d8197d28b8bc4c652e70715bee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381162, "uuid": "ebdf28b1-752f-43f6-a4f4-5054845f827a", "comment": "Malware payload (Gozi)", "value": "8d1113c81f87418553a0a60e851d780fcb1a28d0da52588e79b3ec496f1bf986d01e3a42e0721491ca01c503115a1108", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381162, "uuid": "7b38a34a-e014-4765-90b6-88f3ed6f1edc", "value": "ABA3DF00B9DCC4C1D3EA99B049A4DE75350AEDA62834900733F37F6D7EF63A629AB544", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381162, "uuid": "c6aa856d-f860-4fa9-a59c-d70c502ab086", "value": "811de8e945c2087a6e052096546cd842", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381162, "uuid": "da526723-95c7-4c4d-88d0-9073f93e4b2d", "value": "1536:DWKaY5Se9WnVI78XvnoxJasJvRHKmyGDvDk0Rt9Y56l5ZMpvV05o9OX5xPw8:DWa0eQnVI7qCqZGDvDk4wol5w0EU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617381162, "uuid": "f5f98a32-0783-4c54-b4de-7e4002bacd6b", "value": 103349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617381162, "uuid": "2adccf7a-9514-4e41-ab9e-70a6973c2e4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381162, "uuid": "6d1a60ac-0ef7-400f-b76b-ea7831f93a81", "value": "4732d47c17eb55cda13aea170ac122fe.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890690ae-937e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617345723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345723, "uuid": "a9557db8-d99f-4d26-8c34-0d2e87ee76c1", "comment": "Malware payload (AgentTesla)", "value": "d5a66c820bb80dd21017ff300368edbc", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345723, "uuid": "9f6f5b5e-e482-45b3-bbe6-f8a9f6cfa29e", "comment": "Malware payload (AgentTesla)", "value": "454ffe64e939fa20c917de8e5bf65fb889fac1934177d8de54fe8748c3da343e", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345723, "uuid": "266d0ebe-1528-4507-b522-2d1f60d4932a", "comment": "Malware payload (AgentTesla)", "value": "a19b0ba0de4e421dff831cae2032deebede82e23", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345723, "uuid": "b8509815-ca7e-471f-b451-03853aa83e35", "comment": "Malware payload (AgentTesla)", "value": "26164543d98adf49cffd7f1ff0484722d28492aae09e9ea315ad426428bb7d3b9384a8aa0de2b65306e8797dd535a1bb", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345723, "uuid": "5e92bfcc-35a1-44a0-ad8b-b2136db80108", "value": "6FD423C9131BCC88DCDB52D4828863D4985A1AF5B75C380732869A07B70ECB9DD73B8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345723, "uuid": "ab5c5db8-b73c-44ab-9493-4dc2fbb1a086", "value": "12288:BrmBw33ngyEgr0K4R4XnNQpZkLv7rAo8J4SjzQThkXtjoaOhO6epMAqc:xmBqXugrOGXnNQp0v7rA1J4Sjz2hYGIt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617345723, "uuid": "adbc4607-a876-47e0-9c21-08fd9888b4c5", "value": 635460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617345723, "uuid": "74308772-c4a1-476b-8325-4dd0acf5b904", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345723, "uuid": "a0333d2c-2858-469d-870a-5ea6c32aff1d", "value": "Po__04022021.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98563bb1-93d5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617383115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617383115, "uuid": "8d7edd03-2611-46a3-86cc-5e605102f12e", "comment": "Malware payload (Dridex)", "value": "1a761711003c9c4c2ebd611c73326d7b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617383115, "uuid": "6878d038-d405-4486-b95f-cf597df209ee", "comment": "Malware payload (Dridex)", "value": "45aedc46643ca75f39469b63731e10a9577c2016d315fb7fdcaddadc4034174e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617383115, "uuid": "0d6bf7b9-08d3-40ae-ad61-7b6728910263", "comment": "Malware payload (Dridex)", "value": "aeb18d5bfaf9ce05c7337640a40cf89b2f99e6bc", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617383115, "uuid": "928dd438-082b-4b6e-b724-56a95d642923", "comment": "Malware payload (Dridex)", "value": "2dc360e761b97ce7183286a414e4e5fd0493350acdcea1b53b5e9ceda65aca52fdfb999dbe55f117ef26159416a68fab", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617383115, "uuid": "fd34b5b0-7153-4a8c-98ff-5a48b92d0188", "value": "2314BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617383115, "uuid": "1b2a1e02-7d44-495a-9d9f-7b1c0b971248", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617383115, "uuid": "518517e5-7b57-4748-9af0-6f8ff7e89cc6", "value": "3072:copj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:jpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617383115, "uuid": "28df7c27-e515-4cea-aa93-5ec047da05df", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617383115, "uuid": "67cd5a94-e152-42e1-a932-46d99386b747", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617383115, "uuid": "2f22a2ed-9c36-43c7-b6ec-d725ab261f86", "value": "45aedc46643ca75f39469b63731e10a9577c2016d315fb7fdcaddadc4034174e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6baa02-93d3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617382235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617382235, "uuid": "4cfe5e90-35cb-480f-968a-a42ac77e175b", "comment": "Malware payload (Dridex)", "value": "c84e7eba820cbc9a8823c50267f4198c", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617382235, "uuid": "c2f3e657-52f9-43d4-9af7-042474ab2fcf", "comment": "Malware payload (Dridex)", "value": "46940d63794666c680a67ad2c588ab2fe990cb52f6abae41db13aecf91809f09", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617382235, "uuid": "1c9728a9-d2b4-4b20-a615-c9b6f7cd64ad", "comment": "Malware payload (Dridex)", "value": "eebed05d971a45b82c10573010e5c8aeac482fe3", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617382235, "uuid": "d7db7adb-9356-4238-ae3b-34d460e9bda5", "comment": "Malware payload (Dridex)", "value": "aa7b6cdfdeb47fc102f5714e32d809cad132b824850fdc97e16c5c52a277017afec897a91396d4a7d607774bd838ad0c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617382235, "uuid": "9ef5ce60-83a6-4497-b9bf-66b7bab6be76", "value": "8714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617382235, "uuid": "497038d0-7453-4802-b408-98df0a01e97a", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617382235, "uuid": "35b30816-6821-4052-be0c-cd6818d71f95", "value": "3072:Copj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:VpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617382235, "uuid": "01573334-3b6f-44a1-993f-2ed7d6938578", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617382235, "uuid": "f06dc0a0-02e5-4a4d-b10c-93a338c6775e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617382235, "uuid": "85eb9613-6a53-4989-95b8-13c82f6d3f7c", "value": "46940d63794666c680a67ad2c588ab2fe990cb52f6abae41db13aecf91809f09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa343e8-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617386609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386609, "uuid": "db89e7f2-3831-4641-91af-5fcaeb2c7b7d", "comment": "Malware payload (RedLineStealer)", "value": "c0c71d1a5b14dbe8dbeeefe5014d0ba0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386609, "uuid": "51e44ab6-b6dc-47c3-b002-6a4fc9f2a050", "comment": "Malware payload (RedLineStealer)", "value": "46ee007deb73ea22ecbf7295bbf8ebd0030ade2159352448e81a0097b235968e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386609, "uuid": "e679ae80-cbcd-4aad-9c3e-c5fb79b9a2a9", "comment": "Malware payload (RedLineStealer)", "value": "d5b02a30a9bfabb6e7d517cd16ab2dfe370ac74d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386609, "uuid": "5d902f41-9a39-4b6e-bf1c-e3d24d74453c", "comment": "Malware payload (RedLineStealer)", "value": "b860250b7c9b9d9b8ab0be17a11f1ac45dd136c337df6016f9130443102e0db755d5dac922eacbb7b92099feec0b2621", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386609, "uuid": "91ddb434-8009-40c5-ae5f-886c71bca85b", "value": "95B4011475D1C1B2C4BB153441E28A76AE793132033A95DBBAD91B7BAF203E1B3761CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386609, "uuid": "69a1f278-306b-4a46-9966-538962fc918d", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386609, "uuid": "7dd8767b-cae4-489b-902f-aa65a33965ba", "value": "12288:Ih1Lk70Tnvjc35NY1hR4MegPuxn2TAPejSBE1:Uk70TrcpNYvCnFPfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386609, "uuid": "401977f8-3de1-4fc1-bbdd-2e79e5898247", "value": 502272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386609, "uuid": "b9477023-97b4-43a7-91bb-d4e61b445a7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386609, "uuid": "d26c5cdd-471f-4d43-8e4d-ebbe73b3c2e6", "value": "Revolex Spoofer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1ceb74-93d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1617381623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381623, "uuid": "523e194b-bd5d-47af-a8d6-21f375053ca7", "comment": "Malware payload (STRRAT)", "value": "4c2e6fa5c9e76b3aceae0b16445b9663", "object_relation": "md5", "Tag": [ { "name": "r12", "colour": "#41F559", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381623, "uuid": "8ae14574-55a1-41bc-b182-9ab5b20a0e32", "comment": "Malware payload (STRRAT)", "value": "4732b5a47a56ac6983cd0da7f7bbc6f416194fef5b9ad8d6e0037534deccb20a", "object_relation": "sha256", "Tag": [ { "name": "r12", "colour": "#41F559", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381623, "uuid": "483b4c3e-137f-4592-81c2-858c07972ca4", "comment": "Malware payload (STRRAT)", "value": "fed70b513d7f60198b2405ec1bb3d81f7d84f1d2", "object_relation": "sha1", "Tag": [ { "name": "r12", "colour": "#41F559", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381623, "uuid": "48cf12fe-387c-4a2f-b072-1d52e39cb86b", "comment": "Malware payload (STRRAT)", "value": "78653373d5095a3cf956e258db4f5191331d0b687bc28c26c7f76f7f1008e2d7ce561f52e3419c9d1f335a9c3b3cd2a7", "object_relation": "sha3-384", "Tag": [ { "name": "r12", "colour": "#41F559", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381623, "uuid": "621cea3d-120c-4989-ac1d-324093087cc2", "value": "C493123261ED352CB01F3842789199157E0DDC1A92CCBF2EFE5814E82EE686295BEC1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381623, "uuid": "b044528b-50cf-40b7-b844-54052741c8be", "value": "1536:jnREnyzm3FbSgKbrC4MkCSSanl+1mw7otJEa51PivTCKwC8rrmVRQfGwBRbKS5Dh:jREnyzI/C7P0sEC1iGq8rYQfWS5wgmh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617381623, "uuid": "0c60a615-f51f-432d-82a0-e4e0f49649de", "value": 94988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617381623, "uuid": "dad15f02-9c42-4b80-bfbe-93e24fa808f6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381623, "uuid": "6cba3f7e-2d71-4cb4-b29b-f26ed06ae6f2", "value": "Quotation Request.R12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2532fb7e-93df-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617387217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387217, "uuid": "31335169-ac75-4e24-a13d-87d91ada5bdc", "comment": "Malware payload (NanoCore)", "value": "3513adf2165b82973908722967b1cce4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387217, "uuid": "ddaaa3bb-9d1e-463e-8497-79842ac216f5", "comment": "Malware payload (NanoCore)", "value": "486f2a3279fd7faadca1bb45cc601d47828518030e64887493a793d8e929de6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387217, "uuid": "cff31d28-6feb-4595-a0d1-5c454b42a785", "comment": "Malware payload (NanoCore)", "value": "f0139cedf4330807f0d34e01378e470edd78a913", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387217, "uuid": "0fa8fe3d-26f1-41dd-954b-aa48a971b2fe", "comment": "Malware payload (NanoCore)", "value": "3536f4eefbc5592be6d185a53bb15393c2a976a90091d47683f2ae44619411ed3938c1041f355cee3d2d1e57326cd4f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387217, "uuid": "855311d3-1f2b-4242-bb7e-c0433946d047", "value": "8255C052A3DD82E1CF2661B3BE1977426F7F68310630B45B2F991D7CAE61171022DBA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387217, "uuid": "ae36fc69-e890-437b-95bf-12effc965a47", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387217, "uuid": "edc5b4fd-2310-4672-8f1b-41cee59ce234", "value": "24576:9u6J33O0c+JY5UZ+XC0kGso6Fag8qaBqmsH40HsKgyWY:Pu0c++OCvkGs9FaJ8m70MjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617387217, "uuid": "dc3285c8-6dca-4b35-ab39-9004650dfaca", "value": 1382912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617387217, "uuid": "1c3e217c-d96f-4015-8f7a-9e7e3135ff25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387217, "uuid": "b69cf8ae-590d-414f-9195-9086bf5a63c6", "value": "3513adf2165b82973908722967b1cce4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce6f15f-938f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617353005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353005, "uuid": "7d0bd823-4ae7-4d6e-bc61-d1f5f3de928b", "comment": "Malware payload (Dridex)", "value": "fe8edef676521b6ae1dee499e0fc2eaa", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353005, "uuid": "b5413d46-68c6-4696-892b-220ee7a96192", "comment": "Malware payload (Dridex)", "value": "48e70103f4d781259ca6b1fb695b9584bde521e08025139fac82f75dcd18cda7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353005, "uuid": "bdf854fa-fcc3-40ba-8bdf-a78b9a4271dd", "comment": "Malware payload (Dridex)", "value": "2e235f06910e701047f44e248ef110d731a9cc72", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353005, "uuid": "99d2b86f-12ed-4daa-842a-afb2156337bb", "comment": "Malware payload (Dridex)", "value": "ff0ce62fd1a4993e2fc5f91481d38d6ed5aa549ecbb584ee58878e5ae3ea3dc5783839b534c9fd5eedc22d448d63088a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353005, "uuid": "3e45b3f0-67d0-452e-9935-30e1845feb39", "value": "7E248C5FE339E486FEE3CAF54186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353005, "uuid": "9f6cfe96-0393-46f1-b1be-b9d2bb87d03c", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353005, "uuid": "a5fff7ad-d578-42c3-be25-1fb75187dda5", "value": "3072:K6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:KoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617353005, "uuid": "8b67819f-f785-476c-ab6a-0f32c027bf20", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617353005, "uuid": "18e5ef61-0923-4335-8384-ae54b3b31719", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353005, "uuid": "cfbc7f1b-fb7b-4a49-8bd5-76e6c204fca3", "value": "48e70103f4d781259ca6b1fb695b9584bde521e08025139fac82f75dcd18cda7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a496f16e-93e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617388290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388290, "uuid": "3438877d-4759-4c33-870e-321c0877ec54", "comment": "Malware payload (AgentTesla)", "value": "91ec6fddf5ed2cafefff4e67d0928b19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388290, "uuid": "6a27d3f1-f683-415d-855d-f72309c01433", "comment": "Malware payload (AgentTesla)", "value": "4908ed159346f2f87dc1071ccdfef8dae333c2cff83274b69a42c53f02545552", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388290, "uuid": "50833b78-8486-43b5-af91-6d10050ab42c", "comment": "Malware payload (AgentTesla)", "value": "180d80eaf64d2db34d466578d6e0f043d9e49581", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388290, "uuid": "5bd104c9-1e36-481a-b266-7f6d59bce792", "comment": "Malware payload (AgentTesla)", "value": "877fb70a3e0092938fddfb60fbea931abdeb1ca16396fa90129878f713e52149d27eef8ac77f365bd777f34d71af16ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388290, "uuid": "cd564370-d8de-4ba6-a0cf-83e9cec52dfa", "value": "3193A8817AE51562C69D29F8838FFB615B80E4B029368F933777881DA5ECFC6532CD18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388290, "uuid": "3ad7fff6-ae2c-4989-91ad-b6461fb6ec36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388290, "uuid": "5038a421-729a-4769-b31f-31c87e12fa7d", "value": "768:4SwDj5W0rEI7bp9wnPa5FuM/YzHw5lvkavQk/pMomNhW378WeUQhZ:oDVWuEkp6nPaxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617388290, "uuid": "7a4f876d-02d2-47ed-818c-2d75cae1e4e3", "value": 94528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617388290, "uuid": "8f055af8-314f-448b-a8f6-197be1be30a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388290, "uuid": "921c1fbb-e605-496d-a025-ff1ae08a842c", "value": "PO NO-278 HAC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfceadb6-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617386644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386644, "uuid": "1d3883d8-cc5a-4408-aed6-24a3d09dadff", "comment": "Malware payload (Formbook)", "value": "079caaf95c69373e9b04f1d2d87bc2a5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386644, "uuid": "71cb1be5-7e45-4ffc-b1b9-8075cd8f8734", "comment": "Malware payload (Formbook)", "value": "49642544d350cea8e84602a699e1d5e2a068152c18bfa0ca63dd7679f64bbce1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386644, "uuid": "daf8192f-841a-49c8-9d98-cb27cadd9d22", "comment": "Malware payload (Formbook)", "value": "4529514e2aecb959c2dc00edeabff7fbbd78ebd3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386644, "uuid": "6a62042d-4508-425f-86ab-1e023a9880d3", "comment": "Malware payload (Formbook)", "value": "e58e6fdaad3923f51cddb091f2f2c8ef36ccf3853a4e104d43ac7bd302677c242235725b8fa846b3d7e7910a21fdff0f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386644, "uuid": "d13aff22-9003-49ec-950f-43007582dd41", "value": "6B25AD293F60654CC4A707395858E00C9FE67DA9AAD3C2837EEE37DB6473F1306A4652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386644, "uuid": "c78aa301-72bf-47f2-939a-700881bba33a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386644, "uuid": "26458ab4-1ee5-4aa0-880d-f17d7ec0af97", "value": "12288:6UHHCmpPreDCawQ8WVpxA8fybszSQTAYQ4rwZ:JHH/FKDRbESNzSQTAYQ4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386644, "uuid": "91ca3354-7bbe-4a03-be71-b04e75bfc115", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386644, "uuid": "4d698a10-375f-458f-a763-47e770d4e047", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386644, "uuid": "6acd7bab-e4e7-492b-93c1-c0f4e5629435", "value": "swift_76567643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f0f801-939a-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617357657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357657, "uuid": "75c1ffc7-61e9-4393-a6bd-8c86398c3018", "comment": "Malware payload (njrat)", "value": "a27018d1be5ed4fb9bd98c38543c4bb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357657, "uuid": "115f51b4-eb9d-42d6-854f-c36080e9b07b", "comment": "Malware payload (njrat)", "value": "4a5d2a74803de9f7a73d47ada67ab4e03a466e4bef5dc12ca5ba35343b9a0500", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357657, "uuid": "3d3054b7-80a5-45e4-be33-079c88d0be3b", "comment": "Malware payload (njrat)", "value": "0b1772f6c7181bf56946584556981d75810a1801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357657, "uuid": "8ddc0e2e-e07f-4e74-a47a-c626cc7d9578", "comment": "Malware payload (njrat)", "value": "c2dcc71cce0fbc8ebd28d6ee4e6eff4fb510b56f4d756a572555732ae931647c8003c37c91972f522c812290510341db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357657, "uuid": "6ff7f0f3-1a24-4e3a-82e9-65af1b9f8e0b", "value": "A3447B8276A8DA10C5E4583BECDFA05003FDCD561AB3DF5A7EC436A91E737E26904788", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357657, "uuid": "e08b29f0-36e0-498b-9a48-9e398f5356e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357657, "uuid": "f2d5bece-d8fc-44d6-a889-36645273e510", "value": "3072:zylENHTxcCq1LrrV5ve7kWZJWAsbwdCmgBuBQocc+Y0k0d8HE9WsMS8WVo:zAkHk9M7kmD860kAjMU8WVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617357657, "uuid": "8a596082-a17a-4d7d-b8a3-232dd463243a", "value": 267504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617357657, "uuid": "a6785e5a-a703-48d3-bcb7-1152a5646745", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357657, "uuid": "d2d7c1e5-66a0-4630-8de8-2d327949a276", "value": "a27018d1be5ed4fb9bd98c38543c4bb6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fec182-93eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617392445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617392445, "uuid": "560cfb51-75a9-47ab-a107-fe8e9f6f747b", "comment": "Malware payload (Dridex)", "value": "9c2d116056b5356c2a497e869d4a8e6c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617392445, "uuid": "229330fd-e172-4643-beef-61e54976125c", "comment": "Malware payload (Dridex)", "value": "4c718cb274a0716db8772b1245982f1cb48e1f7f80dea011cd8be01793cab7f8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617392445, "uuid": "0984a729-cb41-4325-9065-74ff25159651", "comment": "Malware payload (Dridex)", "value": "0aeed02de0454e91a2951b71959e531717204fec", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617392445, "uuid": "39e29cff-407f-49e3-9b1a-9bbea789f272", "comment": "Malware payload (Dridex)", "value": "24645dcc6af84203655dda0a2b018bc1461d83a480ad9d88a441761103c016203495a8e045ce8a99328d642edc01e62c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617392445, "uuid": "444c527c-57df-4fbb-b8b8-8f1b2c14d6a3", "value": "1E14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01E124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617392445, "uuid": "46540f0e-8332-4d1f-8c61-93fde6484999", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617392445, "uuid": "8207bbf7-a106-4443-b9cb-413ff4965dd5", "value": "3072:A1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:8i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617392445, "uuid": "29fc5abb-a183-429c-9ae1-a7d5d81708ab", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617392445, "uuid": "1679d31a-e9e0-4d7d-9f25-6981bcbee6b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617392445, "uuid": "ffea8531-8062-4081-b667-3c941bab2434", "value": "4c718cb274a0716db8772b1245982f1cb48e1f7f80dea011cd8be01793cab7f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3125f12-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617386569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386569, "uuid": "a8e03dc1-9944-436d-ae72-d2a4e22d4bad", "comment": "Malware payload (Dridex)", "value": "424ef89b835fb3f266a66675f4b2f1c3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386569, "uuid": "e6190e2f-7531-4dc3-9b2d-4ec9e69d902c", "comment": "Malware payload (Dridex)", "value": "4ca8d8b4b8c8c8cee9c1ace277ebc1e39938f5633437fde2be4fcf73fc1c1acc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386569, "uuid": "a6350e10-aa6b-4455-906d-43cce45ba804", "comment": "Malware payload (Dridex)", "value": "e0c6f8293f72dca7e7bca16275ca890d7dc86272", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386569, "uuid": "b85ba771-86ea-4d2b-a502-eca013881d40", "comment": "Malware payload (Dridex)", "value": "db46a4d674643cd62a1758e2d75d7ffc6546faeda51d5a1891d2a15030f8d7ec37121b331a6c3d4e30bbdd8892b4221a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386569, "uuid": "c5d18e35-e56e-4fcb-bf1e-b4b0da08a9f6", "value": "14248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386569, "uuid": "9d911e5f-25ef-4ede-817e-c7026ea060ab", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386569, "uuid": "4059b3c9-d05c-47a0-bb85-12a2c5d925fa", "value": "3072:f6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:foMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386569, "uuid": "542ce91b-81aa-4f0c-9a6a-af1640745051", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386569, "uuid": "c094b6c0-d88e-4e55-95a4-40e8a7898893", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386569, "uuid": "2e0722af-444f-4bc8-8a5f-8efea17934b1", "value": "424ef89b835fb3f266a66675f4b2f1c3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fc90c9-9396-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617356191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356191, "uuid": "dc16ca6d-c00e-490a-9294-7f9522d52e5a", "comment": "Malware payload", "value": "ac07f0e38c6606440f977ff7e3983a7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356191, "uuid": "6f319828-7c1b-48da-86a4-752cacd4b151", "comment": "Malware payload", "value": "4d688c6baec0d972c248f7747f18dc385e67a0fb2b1a5deb70f324b16220780d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356191, "uuid": "e6dc40f4-415c-4faf-a9e2-a8d22f7ae3fd", "comment": "Malware payload", "value": "961a2594c32c5a9351397d96d1cbeb69ae694c1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356191, "uuid": "cae72129-779b-422a-995f-29c88e751d6e", "comment": "Malware payload", "value": "9cba22fcba7ade9eb102f048160f26d16fea6e26381f454efe73da092a894a374da2d15285df013019d989f00955169b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356191, "uuid": "b7d462f5-bcb4-44af-9233-55f960a0edce", "value": "A536333502EA985BC54B5F76087A9D2C09301E79A0DCBA403316FAABAF773067D3C759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356191, "uuid": "d0946eb2-9ad2-4cdd-8c24-3a144ccf0d3f", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356191, "uuid": "b869024d-be40-4855-90e4-546a24b762aa", "value": "98304:Mh5eXlcj3giQ6UPyleF1fB/F9X9NHIrVjICQLfV3XeHTvm78ycCRjHrwBtvKc:cycm1PylKFzX9IjhEV3uHjkcmHrtc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617356191, "uuid": "e7bc0351-f1cc-4e67-91c8-2bd635e8bb89", "value": 5274135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617356191, "uuid": "20e7940d-0911-4538-8e5a-5d7a6bcb7bd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356191, "uuid": "1034c29b-379a-4772-a3dc-6ad7e46b1df1", "value": "ac07f0e38c6606440f977ff7e3983a7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd3f8a8-93da-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617385243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617385243, "uuid": "0e3bc5b2-d8fc-461f-b2d9-2f75c5279087", "comment": "Malware payload (IcedID)", "value": "05be72eacc1f5a2df5d625b2ae1c58bc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617385243, "uuid": "5709325e-ffcd-4609-8ffa-e882949d0169", "comment": "Malware payload (IcedID)", "value": "4da2043926cca759f672624da138ded20d82922ac1a7438efa0d193cf1cf6afa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617385243, "uuid": "9ed3e5dc-f342-4211-95cc-e52146587142", "comment": "Malware payload (IcedID)", "value": "99a88ba7be58827b7084d86c52a9d1592a3b231f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617385243, "uuid": "b6df35ff-4831-4e2c-a1b2-69c9e02fc5ed", "comment": "Malware payload (IcedID)", "value": "c1fe63b740df2d6fd0ed1ae03cf6f29de1a5c20606f75175181800c6c9bb2cd9f11c5c6741b189d50ee9241feb6f86c0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617385243, "uuid": "45cc0760-cb04-4fa7-9cef-d7a02c2251d6", "value": "0D530A8947503C91C0FEBD34F3A69A58931EFB30AA8F47B794C46BBAC47B5409723619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617385243, "uuid": "8093d15a-b4c7-4503-b120-fbe72f1486ec", "value": "eb10ff98c4adb7472a591c82bd2ff673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617385243, "uuid": "de9893fe-9a7e-4b9d-9f86-2e373d93a2c2", "value": "1536:caCAzXz8T6rLXah8lI+Idu+B3XbuF6dRiF:n/gTkXayetu+BbuUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617385243, "uuid": "c01be727-7318-4df6-b3ca-893f20bf3d3f", "value": 65568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617385243, "uuid": "70f0f0cf-f35f-4f55-8a36-f11493e27f9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617385243, "uuid": "fdf5df99-0786-461b-93d2-baf9db542946", "value": "4da2043926cca759f672624da138ded20d82922ac1a74.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e94f63-93df-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617387248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387248, "uuid": "00526abf-0d51-4639-9636-572e5661cb0c", "comment": "Malware payload (RemcosRAT)", "value": "4e58ff81b29a1afd3417e01e35de3242", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387248, "uuid": "ff54600a-a2e9-4923-90b3-d34972cb3ecf", "comment": "Malware payload (RemcosRAT)", "value": "4f0336839415a09d404edb8a7e86cb0c8796452df54faea5f5f1798925dbc6d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387248, "uuid": "82a1c64c-162a-4019-9032-e216bd0af6ca", "comment": "Malware payload (RemcosRAT)", "value": "bd4784ea0c5afe4c1f23bc550d9dffda0afdf523", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387248, "uuid": "2843b2d8-ab89-4805-8360-1c1677b8123a", "comment": "Malware payload (RemcosRAT)", "value": "abb9812e8c2f6be6a95eabe28a5a3ef5b16603bbcf8f5e6ff68db660eab1e9a4791133c327cc70b7b284fed8c72182ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387248, "uuid": "10a02fc7-73d7-4103-ad0e-2821228264e7", "value": "E0F401E039A8CB95E66C97FA5061184107F9F7E62013CB5C8E94F8FA285AF4D4DC4B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387248, "uuid": "1fd3f74d-53c8-410a-9e21-10fe4836c7a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387248, "uuid": "aff5ff8c-c607-49e3-8a38-50bcc48834e8", "value": "12288:EybeNdAsyQRlqs2RggJ/X4r9nqz9Vch313srgPqXdTqEAjhhD5MmFxWDyqXrQBcb:9eNW9QRQ7mc/7z9VYPqXBqEAjh1CZDDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617387248, "uuid": "0a8b1437-f1a6-41b8-8227-368bbd4a136d", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617387248, "uuid": "a49627dc-3395-4963-9636-73c15795c71e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387248, "uuid": "fefd3e2b-250e-4218-99f0-d1eff1f7d5c6", "value": "4e58ff81b29a1afd3417e01e35de3242.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4142b745-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617386405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386405, "uuid": "ff37cdbb-d89b-427c-a065-8881bae97e13", "comment": "Malware payload", "value": "ff7b041bc53b1df882fdea83c1e167a2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386405, "uuid": "7e0589b5-099c-4247-a7f3-b0d4e051d732", "comment": "Malware payload", "value": "51850e0a344dc146c6180da12e2097bc32497aac360a2d7fd7983a480798392d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386405, "uuid": "383bbbad-e535-421c-b355-ed0981d800ad", "comment": "Malware payload", "value": "c95cb79a8c3d21a3be4a2cbb3c407743d077c502", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386405, "uuid": "494f6318-0b02-4e00-adfd-87f92b984232", "comment": "Malware payload", "value": "7e87558a3cc5fbb7b6fb9f0f08d4e6c7c71d3edd97e4821684af6fad3b594b128f231b49ae58be4f2549139759e460d8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386405, "uuid": "ee295590-eb3e-40d8-b840-6d17f749033d", "value": "5704123CC03B4D98C2E68437DC588546AC662523BDF8A5BD66887598EA136F30F6FF44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386405, "uuid": "a60a5284-3710-455b-9cfa-97eb371a08bd", "value": "3072:TXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGXKC:bE5SDvbXAyHbVt15wTQDmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386405, "uuid": "d2376304-da98-409a-9895-fb1a233b3851", "value": 178001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386405, "uuid": "a48c8ccc-9b62-4cad-9335-233f102953ec", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386405, "uuid": "5937baf5-6454-4801-b4c4-50569e471cbc", "value": "7122681326-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26884c9d-93a1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617360591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360591, "uuid": "976b7c3e-e5cc-4b41-b28b-9f60fbbea4b9", "comment": "Malware payload (AgentTesla)", "value": "26f293d8e5685a584707e7189782a4d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360591, "uuid": "272dd586-5a49-4f55-bfdb-a4a67f34579c", "comment": "Malware payload (AgentTesla)", "value": "5293c4063095cf455e62db013d8767f262fe555fcd7489150e2ac2b046828287", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360591, "uuid": "248f50f8-29fe-4805-8933-b4ed190b69a9", "comment": "Malware payload (AgentTesla)", "value": "6576878355b47565ee18c39f30210d3b9a0c6db2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360591, "uuid": "970bb0f8-3761-4bd2-bfde-4d1ec6f9df90", "comment": "Malware payload (AgentTesla)", "value": "23155cc3b324d4b3f1f0f6ced1f4d86a1903e0f93d3b077fff3b1593aef5880ff132cd51dc2eacef9f2aba09420b936a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360591, "uuid": "50481a88-f944-4896-9f63-15d83800302f", "value": "3CE433AD39B943FBAE17F0F88D5E88F40A4180574D4C742DFC4EA6E02999760161E9FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360591, "uuid": "b061842a-5141-4f92-8d31-910083f92f09", "value": "12288:TvxIH2qhNWQ+bsrLUoFjtUlKpe8cAewJ/7VMEOve5QT5ZN9oZdknGzgAvWN36:TvghNn+4QoPQKc8NJ/7q5W5Q3oZenUug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617360591, "uuid": "4b60ba8d-53f3-4a6b-9d6f-e745797aa9e4", "value": 667832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617360591, "uuid": "f3f7011d-b6c9-4c5e-9a17-4fbc09e85693", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360591, "uuid": "6bd3df29-3cf6-432b-b874-e78614712aad", "value": "09600000000000000000.Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b093b309-9353-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617327321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617327321, "uuid": "cdd54ac8-453a-4745-ac1e-a12839668568", "comment": "Malware payload (Dridex)", "value": "47eaca21a8ff90bc7a88a14fcffadf76", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617327321, "uuid": "7b467ac8-420a-417e-a73f-61d1da75d130", "comment": "Malware payload (Dridex)", "value": "53931147f83ce6b9fba1c6be98e511beb4046e6298119095d0682e90bde5d0aa", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617327321, "uuid": "b0422e6f-3805-41c7-9214-b61c28974334", "comment": "Malware payload (Dridex)", "value": "5f9c4fdd45ee7dc510a4839101faacdbad91fa5d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617327321, "uuid": "37b20d36-331a-479e-9445-dea9b67d681c", "comment": "Malware payload (Dridex)", "value": "52f89c43e9d5ae09fd88e26c8998923df1b3bd16944942bc3ff917f99c037f9088f5d184b3fb56ba93356df158a44dcf", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617327321, "uuid": "554fe5c8-e6d3-4ddd-946e-95acd31b7044", "value": "DE14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617327321, "uuid": "e6a634c5-6247-4fda-91fe-501acf93c875", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617327321, "uuid": "5c34010b-b1a3-401c-9d8d-e76d66d27c6b", "value": "3072:o1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Ui78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617327321, "uuid": "df7dfb90-ff56-4d56-8fd4-fb728a6358db", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617327321, "uuid": "fa2a672c-8cf4-4563-b2e3-18fab95cd0c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617327321, "uuid": "107145f3-bc0a-4ef5-b817-3c00b37fa2bd", "value": "53931147f83ce6b9fba1c6be98e511beb4046e6298119095d0682e90bde5d0aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5146e4-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617386586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386586, "uuid": "e99d2168-cc85-4546-abb6-c5489314bc5c", "comment": "Malware payload (RedLineStealer)", "value": "05f073397d4cb3f19d7b763ec5531ac5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386586, "uuid": "40abedac-ca27-4e1a-8618-9cdc53d19d2d", "comment": "Malware payload (RedLineStealer)", "value": "547a657aafef619da86801e51e88c7330962984b479eb662f4b323c7ba1911c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386586, "uuid": "1c2ee9c3-85ef-4e32-b8ef-5cb76de1c63c", "comment": "Malware payload (RedLineStealer)", "value": "300dae645398245839e59a0f65b254eaa4ee33b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386586, "uuid": "29bc56ac-3908-4354-a6fc-56d0dac8ca59", "comment": "Malware payload (RedLineStealer)", "value": "3a90e9aad74dfcdb4282625c681f66502b775ac4178806419253027dac8e084d8b7abaf36d6da67160b93a14f8ae31de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386586, "uuid": "dc1b06da-0314-4d58-ac70-656b2856b77f", "value": "2764E001B2D1C433E16216790C75D2A44A36FCB26F2456CBBB946BBE5F723C24A36793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386586, "uuid": "8c09bd5d-b59f-4e86-bbdb-bb684d860d7b", "value": "1c8e2b3290de49dd010a7b2f8dc06fd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386586, "uuid": "8f8cde87-a11a-4c66-ba8d-f4a4ac2e0680", "value": "6144:zsEy6ULAsXNWFcAnRnM4Td5VM2S+MjKHmd6rsP2K:Dy6ULVs6An+4Z5VDS+xHmJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386586, "uuid": "3fd9eb15-7552-4c77-a414-01af0541e9ee", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386586, "uuid": "9452531e-5a20-4559-8614-7bde6c0a9976", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386586, "uuid": "6c2df4d4-e723-4c34-9534-b7d81bc6c53e", "value": "05f073397d4cb3f19d7b763ec5531ac5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1722da3-93a5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617362622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362622, "uuid": "2b780ac7-c058-4fd2-adf7-d8bdaaf1f820", "comment": "Malware payload", "value": "87e0355c098d2dfd890ae4c9da26bbdd", "object_relation": "md5", "Tag": [ { "name": "151.236.14.53", "colour": "#BB80BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362622, "uuid": "f6219cb1-74db-457a-a2b7-8bb8a31a83b2", "comment": "Malware payload", "value": "570c3c298c2d30bfd7d824b0ec8e28b3efa51bf269297348fc5fc30cb81a2d7e", "object_relation": "sha256", "Tag": [ { "name": "151.236.14.53", "colour": "#BB80BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362622, "uuid": "d47fb943-7fdb-460f-bac8-770ad0c6e689", "comment": "Malware payload", "value": "5f300f4dd15cccbe51cd4df51ac30b7c2c84fc75", "object_relation": "sha1", "Tag": [ { "name": "151.236.14.53", "colour": "#BB80BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362622, "uuid": "99e3023e-fc8a-4217-9816-158216f77346", "comment": "Malware payload", "value": "d6ee42f3d6ad4013b5ffc00ace4c121876b6465d48393762a04c508f8e4d5996e190df85c772c2f043537f7a2ff5e169", "object_relation": "sha3-384", "Tag": [ { "name": "151.236.14.53", "colour": "#BB80BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362622, "uuid": "5d7cf388-4b96-4b5d-9ad3-c6a77497b711", "value": "A1F633D4F999FC70C416DA3AB7B9C907EC451818D246373B6C3A684712AB1B27DE360A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362622, "uuid": "319ed3bf-4698-4ce1-821b-c343c7e124da", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362622, "uuid": "4c26f309-c141-440f-a16e-5a7dda3861b8", "value": "393216:OoAS/3t2zQuoUrh/dSRsY9+bpNIAQ4tpy0GMxn0UDIpFKHgBM:VD/dUQjD9jAQdMxM2HgBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617362622, "uuid": "859977e7-23cf-41d8-993c-38c9eedbe121", "value": 16770272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617362622, "uuid": "309a7bd7-9185-4f6f-a04d-77742bb62eab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362622, "uuid": "b7dee9a7-5986-4901-948e-59d98cd89fee", "value": "570c3c298c2d30bfd7d824b0ec8e28b3efa51bf269297348fc5fc30cb81a2d7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2e804e-9360-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617332792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617332792, "uuid": "b7be4626-2d14-4ecc-85f2-d147e97d757c", "comment": "Malware payload (Dridex)", "value": "8ece345398123e1981505ede6ccb0d60", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617332792, "uuid": "a6f69bef-a80d-490b-a558-523f9a46db2a", "comment": "Malware payload (Dridex)", "value": "573dab5313d8f69e8aea80e83042e612a27d670b479826278c1ab7a4b2fbe939", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617332792, "uuid": "949e2c54-bb81-4861-b710-a3d342c6a33d", "comment": "Malware payload (Dridex)", "value": "b4f6bcd2243f466ec521a5920145dc0e26acecdb", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617332792, "uuid": "130bd011-1834-4eaa-a5b7-eb15a140c8d6", "comment": "Malware payload (Dridex)", "value": "a65e36f36be3faacd4615e045abc23341b888efc4b124a68a7597479114364ce0509de3d082bc6856a464d9cca4733b1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617332792, "uuid": "1eeef39c-b40e-440e-9267-e24ed27cdc33", "value": "2A14AE9DD729E464FAF3D9F104359A1210BB6C49892F914AEAE0A6FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617332792, "uuid": "6852be71-0967-4a43-8d3f-30d085c412e3", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617332792, "uuid": "dfd648a8-7f80-4d2e-97cb-f435e2eecb43", "value": "3072:N1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:fi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617332792, "uuid": "d8d3dc9b-f5d0-4dfa-bc66-1b8e50c0f66a", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617332792, "uuid": "333c99bd-f94f-43f1-986b-45c86409f5d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617332792, "uuid": "e4e72366-e6e8-48e8-b813-e39ba76db3c4", "value": "573dab5313d8f69e8aea80e83042e612a27d670b479826278c1ab7a4b2fbe939", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899e6787-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617386527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386527, "uuid": "d005d4ee-ab0a-41dc-ad7a-3f8b6c1716f3", "comment": "Malware payload (AgentTesla)", "value": "c3d4c8d60195afbc1da866805c9a0e4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386527, "uuid": "861dceab-79b6-4b82-98a0-64b6e351e982", "comment": "Malware payload (AgentTesla)", "value": "57e6b357aa874dc929d1a47da8e59f5cab08ac96b8ccaed977e9239409b5045f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386527, "uuid": "b16a89b3-f819-42db-82d2-2d28b0b40cfa", "comment": "Malware payload (AgentTesla)", "value": "4e7cee65163caeaf601fd69a909c78a83556ee1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386527, "uuid": "84e9de98-4ca9-4b09-bb3a-3b5c5a858030", "comment": "Malware payload (AgentTesla)", "value": "c00097cdf16fc98359827663c8efa726beaccbecaf924f9f28dab43d53c1e89b67a2642224e4fcaab01b54f29f55881c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386527, "uuid": "52f857a7-bab3-4b92-8209-d0c7094b9a9e", "value": "81F4CF30729CA7A6C43E67354820524153F3B94AEB16CB6F7CD8214E1E63F568336B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386527, "uuid": "4278b8ea-dd08-415e-9c32-c03bc1fccf2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386527, "uuid": "4cba0dd2-c705-466c-abc7-61b26cf71fc7", "value": "12288:yJH3eJKyn8V8gKcrs5Qy266S0W+/nW8qrZyk:yBryq3KcwqbzSUf/6yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386527, "uuid": "6db50c27-70a8-4529-ae50-40b927b05b30", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386527, "uuid": "e12d8344-6982-43de-a211-e52d60beb16b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386527, "uuid": "c36e4daf-34e1-4d69-b809-6bedef60bdb9", "value": "c3d4c8d60195afbc1da866805c9a0e4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf14332f-936f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617339398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617339398, "uuid": "02131ba3-ee1b-4ddd-95e9-fa3bca6c9534", "comment": "Malware payload (AgentTesla)", "value": "2c1a6d1c617445d8b9e6b7af1d7b571a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617339398, "uuid": "482e3f00-46b0-4e19-8917-19a3482df28c", "comment": "Malware payload (AgentTesla)", "value": "592305c859c4bdd2954ef43d4328fd942362f8fa21b1d7ea8d47e46508b0c1c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617339398, "uuid": "b931f160-b420-43d1-adad-37cf6b51fbdc", "comment": "Malware payload (AgentTesla)", "value": "1c3403b4f32e202f0ae09e0b171968d171870bb3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617339398, "uuid": "56fceb7b-c4d2-466f-9c78-f6137adc4069", "comment": "Malware payload (AgentTesla)", "value": "fac64cdc4413689b2dfb5d886db79daab1e25c8e22260893234fbb5ca5c251eb3714085a001a3737c36dbee6a2317b6a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617339398, "uuid": "ea44ba36-befb-48f1-95ba-d4e93d57d535", "value": "3D259D2A3F54614CC0AB17395868D04C9FE67D99AAD3C2837EAE37DB6073F1307A4652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617339398, "uuid": "44630d00-0f48-4041-85d2-50bd55638972", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617339398, "uuid": "adfb0cf7-0ac1-48cb-9ca2-2f6d87c67c39", "value": "12288:b4uCRAx8CknCJ9doxGMLJ3oGyOTjxG79UoxjHrmr5Z7hBmdZ:b4unx4CndozojOJa9PHryLhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617339398, "uuid": "b8387af9-25c5-40d2-bfd8-485173641338", "value": 1037312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617339398, "uuid": "9f5ec1eb-3e34-47bd-957f-ba9d31db0f3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617339398, "uuid": "8629250a-963b-4771-8c84-71d4773c2775", "value": "fyZ6iHys7ClIHFR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7f866a-937e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617345674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345674, "uuid": "9e8154a9-493e-4070-9c38-ba76c189a101", "comment": "Malware payload (Formbook)", "value": "5856cf17f0da125336f20a5a4fae5121", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345674, "uuid": "bef28f1c-3b87-4748-a5e2-349cded7c4b5", "comment": "Malware payload (Formbook)", "value": "5aa64b3eef03b9c837e37102be20cb4f537c524b2a2531bf1bf6dd6a02461d7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345674, "uuid": "5a473be6-3d9b-4a63-a6b9-06df35c6548c", "comment": "Malware payload (Formbook)", "value": "3998d8651f6a07c33ba730fcee7f0e689b962e6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345674, "uuid": "3e6f7bfd-f52b-43c7-abad-132f4f7951c6", "comment": "Malware payload (Formbook)", "value": "7d3b0db638c37f28fb660b78106c271a98d3e3dd45989c45a7bc3a0ee0ec92a05d487c984a24248b96605cc55deed726", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345674, "uuid": "47f50873-f656-4915-bd0f-baacf3e7647d", "value": "0FD42323A260E6B3CF294370291E5D078FE2747AD2D16A8F5BF56213D667BB2040F593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345674, "uuid": "711e5379-168c-4509-8b5c-26647c18cffe", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345674, "uuid": "0d086333-449c-4b79-878b-395413de8b8f", "value": "12288:Y0dhClzIrxQ2dqljmFTdEKu9W/p/7s/1h:wXBgTixMF8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617345674, "uuid": "edd0b7a9-b9c0-430c-a571-16397edc7304", "value": 655213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617345674, "uuid": "16f49ea7-32f1-4502-80ad-b0e0c83bfb17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345674, "uuid": "4943e2b9-78a1-4931-bd9d-c235060dc7f3", "value": "REQUEST FOR QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe61735-93c3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617375290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617375290, "uuid": "480187c4-4af4-4e86-977d-59faa2417797", "comment": "Malware payload (Dridex)", "value": "12bd5a9d53ea0d524cf54599dcaaafa6", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617375290, "uuid": "a0a31568-c32f-44ed-9a57-09a44ebcc6eb", "comment": "Malware payload (Dridex)", "value": "5b356a74a574a17f9a549dddcda41a0dbf6c312048d8a07c410ddaa6848c4e23", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617375290, "uuid": "5c568b89-ca71-4ff4-9ff9-82ac34bdb2de", "comment": "Malware payload (Dridex)", "value": "594a3dfebc0916cdb93de10a4bd97894e1dec899", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617375290, "uuid": "98cd3a22-85f2-480f-b9e4-26cb36b782c3", "comment": "Malware payload (Dridex)", "value": "d3b62e781fcda2399649416eb3993a82bc53234301a8f9db0735c3926dad88c5972b0105604f8a235ed15170513bedaf", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617375290, "uuid": "79b4c772-1d78-4a97-8769-297402c1e457", "value": "FE14BE4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617375290, "uuid": "de7bdf5f-1943-4dea-af23-e8157535799c", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617375290, "uuid": "b9bdb896-4178-4f43-abfb-6fa1b85107b7", "value": "3072:lopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:KpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617375290, "uuid": "8338df31-de4b-455a-830b-68fa9cd13ac8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617375290, "uuid": "f6f71adf-20c7-4ff7-ae85-791c9b8bdc0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617375290, "uuid": "d02336bf-a6db-43a9-9e03-adc1c8ee58ff", "value": "5b356a74a574a17f9a549dddcda41a0dbf6c312048d8a07c410ddaa6848c4e23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a2d7ae3-93b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617368489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368489, "uuid": "35624cc3-e21f-4888-8eb0-d9ace03cd57d", "comment": "Malware payload (AgentTesla)", "value": "805d2aa8757f45d7f5843aa225d1ef4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368489, "uuid": "a38b0e49-91e9-4ef5-abad-48d3e669abe1", "comment": "Malware payload (AgentTesla)", "value": "5cdc13420f4812754d41158ca2015d69c2d7c903f1b00f90db14705eee8f8cc8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368489, "uuid": "6bf31dcc-09af-4896-979d-7b6b33f70c22", "comment": "Malware payload (AgentTesla)", "value": "fb417f0d3b84d44b930f0bf2e214041a30d41e7b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368489, "uuid": "01fc3d26-c349-4f93-82c9-cf4eedc000f3", "comment": "Malware payload (AgentTesla)", "value": "77715ceac0a15137b473895c358fc5086826ce85f273ca76b282f968c2ab419af4044a7097e5e9a885eb08a9d0bcfb83", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368489, "uuid": "039906a5-1162-4563-ac49-f5f79da4fd3c", "value": "10E46A63334B7BAFDD7953B52452410033A1AD32F66AE10DADA4325D0F776C08BEE662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368489, "uuid": "0ccb70e0-4d82-4158-86f1-746a5d787f7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368489, "uuid": "2b85a23a-cdab-42dc-8a36-f5ac16de6554", "value": "12288:5aMx6FbkbWZirwZPol8GiDAeUBIkcXyZ:5aQ6FzvZQl8GiDGI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617368489, "uuid": "fabded18-ddd1-48ce-b312-19965665da37", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617368489, "uuid": "098edd9e-332c-47f8-a021-60798bc213e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368489, "uuid": "ae0d69d9-62f2-44a0-abba-a2bc7436e79c", "value": "Order_BC012356PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63fce13e-93b4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617368854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368854, "uuid": "cd5b7711-e7dd-473f-b4e3-e590b538539f", "comment": "Malware payload", "value": "a09817d318a157618be92fa5b12b1e85", "object_relation": "md5", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368854, "uuid": "5d46c144-1c1f-4d6a-94c9-2c81e359fad5", "comment": "Malware payload", "value": "5d55bfcf9a261309ad1e3b0dd815327451283f9f25ba5dccc1a8c5abc8cddd75", "object_relation": "sha256", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368854, "uuid": "cc49e4e5-690d-4d95-86b8-ff324a544594", "comment": "Malware payload", "value": "b1cc812b6011afcb3012fef0af22621579e08e90", "object_relation": "sha1", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368854, "uuid": "0cd20e3b-7039-4586-866f-f71067f43377", "comment": "Malware payload", "value": "e106e0978c421badab143d7f43c852809bcbd5d33bf26f208ea62765509f54c2777d40fe43d64544012d0740b8bd97fe", "object_relation": "sha3-384", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368854, "uuid": "f03d0bd1-b84a-41ca-89e1-c309a1c83e48", "value": "ED91654B173E3CA586C302E241DE8BF8F2E24D994344767BA9693A63744293FD84537D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368854, "uuid": "ce6566c1-fade-41fb-9afe-133b132b5709", "value": "96:DcFYPJ+fE2QRz2HOp/3u7DAB515najUHGzLBWxplTqL5fs:DccJ+Mhsup/3u70l5n8UHaAxpl80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617368854, "uuid": "70efa423-8e00-4828-9a47-9d3330b854af", "value": 4552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617368854, "uuid": "5f9b9c41-4936-4e07-bd87-5626d906da78", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368854, "uuid": "4ca5b159-f921-4cf7-abee-e43b75f7bceb", "value": "YWsB2.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "751be527-93d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617384345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384345, "uuid": "54ffaeae-4e1a-4b0b-876e-dc1e5fd0041c", "comment": "Malware payload (IcedID)", "value": "22c6bd5130155b5c1171afd45b44b062", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384345, "uuid": "fb109ee3-6e30-4ec6-acea-23536bd6363f", "comment": "Malware payload (IcedID)", "value": "5da2e9166e532add80cda782122f07d05f869a9ffb5bc6ff8367e5ac2d10f58f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384345, "uuid": "5ba93fd8-580a-4c33-807d-da33cd5e3e62", "comment": "Malware payload (IcedID)", "value": "cf66d1f9c6b154eac3135472f18db2d6517c9f58", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384345, "uuid": "7c8a759b-7ad3-4611-8441-5862fac7f377", "comment": "Malware payload (IcedID)", "value": "430f6a9eaacd02b980c6c664711e88ca9b2968e228e08ec6e9f41e14ca3a724f2c858ff1ee15024f91cdc36036f4c939", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384345, "uuid": "4acf98b5-4b7d-4913-ad70-0a090f9a2541", "value": "B1530A8947503C91C0FEBD34F3A69A58931EFB30AA8F47B794C46BBAC47B5409723619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384345, "uuid": "3ecefb03-5cad-4c70-bb21-4f0eca3d883f", "value": "eb10ff98c4adb7472a591c82bd2ff673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384345, "uuid": "ef6585f2-94fc-4f58-adee-3951452249ce", "value": "1536:caCAzXz8T6rLXah8lI+Idu+B3XbuF6dRiF:n/gTkXayetu+BbuUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617384345, "uuid": "45eef19f-0229-404a-a7aa-f3ac99f70b84", "value": 65568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617384345, "uuid": "6527bd16-afa1-47d7-8ee5-d53ae8d9db87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384345, "uuid": "2ff38328-204c-4b75-8ec3-c673597bde82", "value": "5da2e9166e532add80cda782122f07d05f869a9ffb5bc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22fc9428-93f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617397092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617397092, "uuid": "581f9661-42d7-4910-9d8d-b7fcf77a974a", "comment": "Malware payload (Dridex)", "value": "912e61d9ea6416e2fad011af893adac0", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617397092, "uuid": "8bef6193-4ee5-4cb1-b63b-e22905f3c138", "comment": "Malware payload (Dridex)", "value": "5f3a108c0094c9ab111546bff7c50041af65cb48b1281f30e04ac56a090c9d5e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617397092, "uuid": "a5e8a46c-8018-4510-8279-3f9145fcc8ac", "comment": "Malware payload (Dridex)", "value": "1bc5d2dd0cd1d0c7e5245bf82fefc70d9b9cb0a0", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617397092, "uuid": "724c472e-5dc3-43bc-a477-e5539622f7b4", "comment": "Malware payload (Dridex)", "value": "7db120f134d739a027d5bb7ec9479d54309cc937fa9c68c876ecd25513852de1899737d292d68a5210aec0f40bbf2e08", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617397092, "uuid": "df3109c6-d076-49d9-808c-ad6a178c0ca2", "value": "A014BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617397092, "uuid": "dabb1eb8-53ed-4d87-84cb-5952c29dfa2e", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617397092, "uuid": "2da47651-cc14-489d-ab32-e6c5effbbedf", "value": "3072:jopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:kpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617397092, "uuid": "ca0aea15-03df-4921-ba20-a2207f683866", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617397092, "uuid": "22b16ef4-5d02-451f-984a-038939877a2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617397092, "uuid": "e7392998-56d2-410d-a287-677c858f311a", "value": "5f3a108c0094c9ab111546bff7c50041af65cb48b1281f30e04ac56a090c9d5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aee8e2c4-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617386589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386589, "uuid": "df26d3d5-9c13-4579-a953-dd2448ce262d", "comment": "Malware payload (AgentTesla)", "value": "515408efe146604ef91c052669b3d369", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386589, "uuid": "ef4d185e-be8c-44b6-9656-c932c352d8c6", "comment": "Malware payload (AgentTesla)", "value": "5f65dcd51f01bf4f69f2c831cf863fedfff66cca9e1ebde499eb20b9a9fd7045", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386589, "uuid": "a003b868-3199-4e0e-81a5-c8c1659468e7", "comment": "Malware payload (AgentTesla)", "value": "619de54b98cad3e6d2ebfe7f0ac51acbb8b381ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386589, "uuid": "7bd4addd-963d-4a42-b43a-433b6000dbc1", "comment": "Malware payload (AgentTesla)", "value": "1ee62b2e130ba05beafc9ac323fc990f5e1dfd7002dbaf19917d3e22a870763056d1ff0d1d3dc6ed3b7be6e8180fe0d2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386589, "uuid": "581a32a5-aaf0-4d61-af61-6a403da2350e", "value": "7F05BEDC756472EFC85BD472DEA82CA8EA61747B531F4213A01715ADEA4C897CF280F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386589, "uuid": "f4235050-5cf1-4d9b-8b7b-4682507e1fb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386589, "uuid": "b77eae2e-e65c-42d9-8550-a83516a0a16b", "value": "24576:qljDzSyqCUwbZlaaksHlBT9qReMPHKfPq:qlfzSlCUwbD/FdiFPqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386589, "uuid": "4234a2f7-2e69-430b-88da-3b9ff257e222", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386589, "uuid": "759f6b7b-a16f-45bd-a729-0732a7c1b34e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386589, "uuid": "7fd0c019-3e59-418a-a05e-58691cebb47b", "value": "PO 9506_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0365243-93c4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617375881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617375881, "uuid": "f8648e91-7094-4190-864f-a0c95ca4bb5c", "comment": "Malware payload (Dridex)", "value": "f4ac42ee4da67a54d589e68058d8a074", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617375881, "uuid": "7b59b59f-3012-4c42-b8b6-56ccc6648dc7", "comment": "Malware payload (Dridex)", "value": "5fd1bc95f97b887378c80c109941e1d67c1da559d2f9ae349e28e726150dabd2", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617375881, "uuid": "8c939f86-4a79-4a67-8c23-df13bf444705", "comment": "Malware payload (Dridex)", "value": "7564f91d8c9a8a6e0759e3be91a92ff567418126", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617375881, "uuid": "af967d16-b393-4d69-875c-1b1ea0f53a11", "comment": "Malware payload (Dridex)", "value": "1eaf2d69570f97ca86c8354358259c59b6d27c849ad7ccaca987af619ca30b4e8305a6d3f3ca8edad38ff5c113fe8d87", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617375881, "uuid": "fb579a70-75a6-45ea-a613-6cc2086d617a", "value": "6314BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617375881, "uuid": "8a1ed6a9-4978-4355-88c0-79deab95b022", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617375881, "uuid": "68cb0d48-3440-4992-9619-4b54f28c232b", "value": "3072:Dopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:EpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617375881, "uuid": "a3dea6f2-3d28-4bd8-8317-0138464145c0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617375881, "uuid": "7754d6d4-307a-4729-b8f9-9c528da65821", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617375881, "uuid": "b373025d-2229-4146-aa69-f42cc3b88c97", "value": "5fd1bc95f97b887378c80c109941e1d67c1da559d2f9ae349e28e726150dabd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62a43f1-939a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617357825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357825, "uuid": "c5057cae-f453-4f03-a8eb-4316847a012b", "comment": "Malware payload (AgentTesla)", "value": "5de101b47268231aa82e8c5b68d79056", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357825, "uuid": "d6ab4192-5b3d-4461-9a52-abc969f3085e", "comment": "Malware payload (AgentTesla)", "value": "62277d9bd3168bd577060c5e7717682ace88cb88a0418a543dad2fd9a5d15ea1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357825, "uuid": "846ad877-4c8b-4ee0-b580-99c3605c3af9", "comment": "Malware payload (AgentTesla)", "value": "17de6e804fcf58027db3b5bffa1b8fe11d1c3c87", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357825, "uuid": "8c6a027b-5e01-415b-80c5-4d43443e4668", "comment": "Malware payload (AgentTesla)", "value": "97bd64b2680902b2c89f5e82f5e638573a20442f4293c53fe6bdf99110f5e647ec1031f0429a00fd90dae4b13a0a9332", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357825, "uuid": "3e95af59-706d-48c5-88d5-705cb7befaeb", "value": "E79423293C04A6E47207CCC7CF16FD2DF63278D6889EB5C18C5F82A2BA35189B654976", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357825, "uuid": "9aba63da-525a-43eb-a8e0-115198fcf8bb", "value": "6144:WzqBSjYfYqIZTcVJgcHZq9csjUuHJknwEUOrlvrefBONKjHbENbDBQouqTJ0MUOH:WDaI2VJnkc3FrVefjjHIxBd1LUBVDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617357825, "uuid": "668d1720-0909-4eb2-ab80-c124432d0381", "value": 429569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617357825, "uuid": "911c2832-2a46-4aec-bf30-28e569796556", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357825, "uuid": "fa481828-1e1c-479f-8419-2b76823f7a79", "value": "Contrato firmado.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1afadeb7-93a1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617360571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360571, "uuid": "bd95201a-e966-4fa8-ade1-d6932bae2020", "comment": "Malware payload (Dridex)", "value": "a5992950c1da9655a001f8521ddeabd9", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360571, "uuid": "495b45df-e01d-4740-923b-eb24d84462c3", "comment": "Malware payload (Dridex)", "value": "62acf5f397a7a7b1efad1098297bfe8a6dab620ac5e5e2cf702a361749628229", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360571, "uuid": "991b68f8-8bf3-44ca-9124-7848d769ea78", "comment": "Malware payload (Dridex)", "value": "8098b835242cf548299da04cb11151124ca6828e", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360571, "uuid": "74e40fac-bfbc-424d-b058-9cb37559c365", "comment": "Malware payload (Dridex)", "value": "1e26eeb3c377423c460b00161105748258afc6a502c45b4974f195851b4055ab5a4b5ed1b1c88629d86b46ff7e5a8ba2", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360571, "uuid": "59824ba1-6948-419a-8756-c1e3ed305d45", "value": "4F14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360571, "uuid": "1051d11a-eec7-4ad4-aff3-8dfdf3d35516", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360571, "uuid": "b0fbb80c-9153-4b0d-be1e-12e6567584f1", "value": "3072:wopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:XpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617360571, "uuid": "0efa8eb0-8e26-47e4-b0d4-fdda3740cde9", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617360571, "uuid": "797f93b0-7d4f-4b40-9310-39b0a5d6bfc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360571, "uuid": "d629281e-55ed-48a7-a2ee-48b442c9e8af", "value": "62acf5f397a7a7b1efad1098297bfe8a6dab620ac5e5e2cf702a361749628229", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11fdabb5-9383-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617347671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617347671, "uuid": "736d0fe4-ee60-4d4b-a750-c00ffedbd82f", "comment": "Malware payload (Dridex)", "value": "565dea499a2fc62db70578db55bb1d08", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617347671, "uuid": "f5a46384-c4dc-4d93-a9d1-6054929bee9f", "comment": "Malware payload (Dridex)", "value": "62ee04cca57cd1f1ee10d34134617da6b5776579f77e4c981b8a3d0dc41d98ef", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617347671, "uuid": "33233f66-5dec-4d0c-8cc3-b254da864653", "comment": "Malware payload (Dridex)", "value": "39c452b130f847abc467b5f3725df1600a838212", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617347671, "uuid": "9e3470ff-825a-4f8c-adf7-f92669ef0fea", "comment": "Malware payload (Dridex)", "value": "2480111054ec064f5f78a0a1e1256f3b39a5e5a4e9dd0a47549191f9684e82e2f68b5b8b3e852f5f9f9c21fbbafa5f4a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617347671, "uuid": "c087d8a2-8e71-4d89-8a16-5f290d4090ed", "value": "E514AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617347671, "uuid": "02408bf3-7664-4c33-9f99-7a7405113b20", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617347671, "uuid": "27a6d82c-7a1b-4d89-a862-9694806cd995", "value": "3072:71i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:5i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617347671, "uuid": "b31d7dd1-257b-4d9f-a9d7-82c21c4c307f", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617347671, "uuid": "a7fb44de-bef4-4c9a-a0ba-4f1d0190f8bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617347671, "uuid": "97ed3b06-4c73-4788-aeb1-47e8659026de", "value": "62ee04cca57cd1f1ee10d34134617da6b5776579f77e4c981b8a3d0dc41d98ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e2ff5f-93bb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617371991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617371991, "uuid": "7a4e9ab3-1999-416f-a28a-619a5969967a", "comment": "Malware payload", "value": "75c1ff39aac846286257e7186dc0096e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617371991, "uuid": "d415d78e-4432-42de-beac-c72aae47b340", "comment": "Malware payload", "value": "63067c7050bab69e0903ed3887710e4fa50d30d5865c765941df579ddb9b4ab3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617371991, "uuid": "1346ff82-2836-4314-8fcc-b6d5d6431967", "comment": "Malware payload", "value": "2e953e5958353e2590fd14300a492a786d6930d5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617371991, "uuid": "118e19bd-789d-46b3-a875-52f43c46cd64", "comment": "Malware payload", "value": "85666d968bdb67eba5caf3f9eb81e8edf8055897777114d045d376c77a09d7f12102fca0a411f48e60842f0081f6d631", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617371991, "uuid": "2083d8d4-49e9-41db-90a4-9fbe2862b946", "value": "97247D36BA808437D1732E7C9E1A56AD913EBA302F2C14477DE45E4D9E3E3A2652D1C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617371991, "uuid": "2d46de6b-1207-4802-a920-a35eabd0ec99", "value": "8acb34bed3caa60cae3f08f75d53f727", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617371991, "uuid": "d4f9a2d9-81c5-4cd9-828f-0fbac10858b5", "value": "6144:/yJE1yd7WTJmcyfZmPWna4DQFu/U3buRKlemZ9DnGAevI4P9+:/U/d7WwvUPWa4DQFu/U3buRKlemZ9Dn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617371991, "uuid": "5a257c12-9e6f-4991-b8b8-886077ead4bc", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617371991, "uuid": "5140d6f5-7181-447a-a8d8-0680bf894425", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617371991, "uuid": "e4264b7d-bbd3-4198-bfdf-4897c6412d48", "value": "SecuriteInfo.com.Trojan.Encoder.33750.22954.16449", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b43e13-93d4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1617382525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617382525, "uuid": "f809f2fa-e529-4c91-8581-d54d6cd7435f", "comment": "Malware payload (AsyncRAT)", "value": "a6fe2893318a584564abf256208e197d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617382525, "uuid": "3db175fb-8ece-470e-be73-24cbcccdbe52", "comment": "Malware payload (AsyncRAT)", "value": "643f61fd7af19cc12fca0b1c5aeaee670a575ce6ed56540466deb760c2d20f5f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617382525, "uuid": "94dc7667-430e-4946-b977-ce3117dcab6d", "comment": "Malware payload (AsyncRAT)", "value": "2f907690fbc0a0fce60f6883ef3f17004eba9103", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617382525, "uuid": "ba8ce812-4e1a-4faa-a950-e9ea92793316", "comment": "Malware payload (AsyncRAT)", "value": "7aec3013de42388d7d9007d59eb51b885379749cbbe929b3af931cc7f5079f95290012574ace9fe884e9853cfe13a37b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617382525, "uuid": "2acdd3f8-ce2b-4b33-a467-2f15e859e6d6", "value": "1C231A003BE8822BF2BE4F7499F26145867AF2633603D64D1CC451DB5713FC69A42AFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617382525, "uuid": "bced50e5-8568-4884-941d-2cd629c5fada", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617382525, "uuid": "a348ac89-01ac-4cbc-8c84-d3c25798997d", "value": "768:bu439TskvpDWUPANxmo2qbPKjGKG6PIyzjbFgX3iQSU8D9ou12eFhlBDZ3x:bu439TswI2uKYDy3bCXSQS3D9ou1vhrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617382525, "uuid": "bc4056b6-13fd-4671-aeba-23d70b4c2089", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617382525, "uuid": "f8d5eb7a-e658-473c-a643-3d4d9537ec8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617382525, "uuid": "ca9d6e72-6f20-4964-851a-dd879362dae8", "value": "a6fe2893318a584564abf256208e197d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f147c2-9360-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617332973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617332973, "uuid": "4c2b3aa2-0540-461e-957c-36fdd20fad7f", "comment": "Malware payload (Dridex)", "value": "9c4c1108c2e9c53b8caac3a8e91711bb", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617332973, "uuid": "8ca8b80b-8d61-49ce-a8e5-e9645e41600b", "comment": "Malware payload (Dridex)", "value": "6506f46f3c264cf848ca1090ac7f76e30d7fe63a9331adde913e180abd2f7fa2", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617332973, "uuid": "1703ea8e-2d4f-4eb9-bbfb-fdcc31db851e", "comment": "Malware payload (Dridex)", "value": "a3e1213f0eeee96d72be5f684afba0719e79e024", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617332973, "uuid": "7e87820e-85ad-495f-9534-3dccf353e436", "comment": "Malware payload (Dridex)", "value": "0eaf23671c9b9553adfb31d8eba3d2be8c34fdfeeea222a52226bbe744e0cdfdaefa992b395f64dc17b24fbe4de6dd96", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617332973, "uuid": "1dc59db9-38f5-4779-804e-8cba44ee66e8", "value": "7E14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617332973, "uuid": "9f093e95-a2ee-4518-9475-56bbddc9927c", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617332973, "uuid": "747640fb-1a6f-4535-903b-0c5c832d14f1", "value": "3072:yopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:FpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617332973, "uuid": "cfc4d870-7066-4c2e-8465-ef5321fa2eb3", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617332973, "uuid": "884628fc-5034-4b1f-a645-ef09906640b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617332973, "uuid": "ea6c00ea-5a45-4d5e-91a2-c7abcaeab692", "value": "6506f46f3c264cf848ca1090ac7f76e30d7fe63a9331adde913e180abd2f7fa2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc85de55-93b1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617367768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367768, "uuid": "b4cfc65f-61d6-4748-8f07-f18299d27481", "comment": "Malware payload", "value": "4579a1cafc6ab34864a1bbd8a6444ddd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367768, "uuid": "a34cdad1-5a4d-475c-954f-649b2d28dd7f", "comment": "Malware payload", "value": "665ed55b62b72a0b137e8af03908ccde40b775790664a16f47c1248d88711f08", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367768, "uuid": "115b1b0e-a05b-4e8a-8f4a-e6d23d29ec57", "comment": "Malware payload", "value": "10b5ad1a27d639e0e5f8e6662e8ea6c8cf9d5e4b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367768, "uuid": "51f01777-43c3-461a-b343-b610d86f921f", "comment": "Malware payload", "value": "67fd18ae5a4f9665406611d797cc0c5c880efa6a23ac5d76c9176d8b6d660409955d0c448222e53a73cb1b3d0c142a07", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367768, "uuid": "e27e5740-17ad-4e45-b947-cef92a0dca3a", "value": "D82349F089E521C0F03692772DF92657E9643D1DF72A8E9F90847E44762A2F03236B5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367768, "uuid": "3ddc5fcf-7a91-4527-b52d-60c61f84f303", "value": "899ed385f326a8d1a9ab31e32ad45491", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367768, "uuid": "cb717949-29b2-442e-8f28-6057d5117ff0", "value": "768:WKizmGMOsCnfC8OiFEcn4HA6r5gWMuwVVSxapVt1s7+4FGAlFR4lVB:WKiiHCfCVYEc4H/r5MdVMxU1i+4kAlUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617367768, "uuid": "9321571a-d9d3-4352-a2d1-b2e6dee673ed", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617367768, "uuid": "8e581ad9-9b41-4ea1-a1cf-8b44ec784c08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367768, "uuid": "b76287b6-045c-42a5-990a-b0a543dd1fe1", "value": "spawnx32.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c618250a-938f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617353127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353127, "uuid": "4111c67c-8fe0-4f6f-bd98-019291da7863", "comment": "Malware payload (IcedID)", "value": "678085bbf8297342e8a12e4fdff5c9ef", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353127, "uuid": "d0957ad3-74fa-4551-bb68-7cbfe6f7f4a8", "comment": "Malware payload (IcedID)", "value": "67241ad58163c20ab219130474e735e792dfece91963367f073cef00ce44734e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353127, "uuid": "f54f1ee1-6703-4106-8213-6b7bd05fb071", "comment": "Malware payload (IcedID)", "value": "87ed491737889741f19183592fbc683670ec1947", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353127, "uuid": "07e5f872-58d3-4626-95d8-3f0c0124ee35", "comment": "Malware payload (IcedID)", "value": "96f6d3ad22aa4c8c14805e8f4d2bfc34a2e597c16e0d129f810aecdd7d3575629bf0b056bff5ff3377411b1caf5fab8b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353127, "uuid": "5130aafd-001e-4bd2-a09f-c90c69e84efb", "value": "4A044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353127, "uuid": "26b46f15-fe42-4c01-883d-5dace82f0bb1", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617353127, "uuid": "3fed5772-aa3c-4b6c-b2ae-018f68e4838a", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617353127, "uuid": "4ac83ea8-3127-4461-a672-e03856816c22", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353127, "uuid": "d93d9927-04b4-4101-aa16-36e87bf7e4b1", "value": "document-665241764.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc03c53c-93cb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617378907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617378907, "uuid": "c3956153-6160-45db-9462-d01dde991942", "comment": "Malware payload (Dridex)", "value": "46509b41d6fd9a97c68c9fc8e671db21", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617378907, "uuid": "e0cdd8e1-4732-40fb-b555-ba21d3d11b11", "comment": "Malware payload (Dridex)", "value": "67aee328c973c1cfda4822fe8df2d51b7a2db68825f12504648712a227582723", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617378907, "uuid": "bf96501b-b263-4fb6-a48b-b35bae8122a1", "comment": "Malware payload (Dridex)", "value": "677f3d7c581462a95feca158e2ec4187ab64a0df", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617378907, "uuid": "9cdde033-78db-452c-8e31-d389faa26282", "comment": "Malware payload (Dridex)", "value": "449d05e40a23e17c72d7a330ea4de1891ee0dfa332d9726d994d3a6db0aa3dbc4d0135b95363bf26fe49eafaea7d8328", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617378907, "uuid": "b7a85444-d6f0-417b-8de3-7e7cd873f8af", "value": "E914BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617378907, "uuid": "22cc5a68-d952-4fc1-8d98-ac84ebdf23ce", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617378907, "uuid": "b304b9ec-cfcb-42fa-a46e-ba7ff01b9e45", "value": "3072:4opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:vpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617378907, "uuid": "87c3984e-51ad-4dfb-9fa2-9434e20ada29", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617378907, "uuid": "f20b502b-68db-453c-9c9d-d94ef3de7b78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617378907, "uuid": "c4bfe971-11f2-402c-9835-ab4eab3c555d", "value": "67aee328c973c1cfda4822fe8df2d51b7a2db68825f12504648712a227582723", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71bb86e3-93b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617368448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368448, "uuid": "44d9e915-79e3-49b8-999b-bc6cc3c3bf28", "comment": "Malware payload (AgentTesla)", "value": "a7b438f8c0a45ef104ee69796d9e3d20", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368448, "uuid": "13993578-c7e8-4f66-9879-83d5846f8f72", "comment": "Malware payload (AgentTesla)", "value": "67d4f9c31ff9df7adce1c43573c3ac43e0aeed6dab1d3c37981e50473b314183", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368448, "uuid": "2e928e1d-13a2-48cd-a206-e820638212dd", "comment": "Malware payload (AgentTesla)", "value": "53ac330e748d8bbedcfed441f68b6af9ddeba671", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368448, "uuid": "31268cb1-0172-4d4f-99d7-6882f201ad27", "comment": "Malware payload (AgentTesla)", "value": "3986279da5d0ce2541d3aa690e07799877c7921e42ec17f5c00518f2dd14d09e14f23d5e58de86248d05d677538167f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368448, "uuid": "25bcbf9b-6f19-4186-83b7-135ebd24c576", "value": "AAB4DFB532D55B05F07EEBF878A4100083F8B53E92E6D6191DA810DE1973FB199A2E73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368448, "uuid": "6a131e9d-dd92-4118-90c8-2a282c8c34a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368448, "uuid": "84a665bc-0ed9-4d76-8f3a-06ae442c11bd", "value": "12288:O8GwCMr1rGtECjsmDuWln6YE66lOIiY5PtKRhVdHQtTAhy:WOCx7N6460i5FKRhVdHQtTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617368448, "uuid": "2a507067-c96d-4122-98dc-6a83572a1e05", "value": 515584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617368448, "uuid": "cc0bf4b9-e3ac-40cc-99b8-bcc40d8144f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368448, "uuid": "6ec056b4-618a-4bb3-8dad-313e45358605", "value": "edc0094847.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a1ccd1-9380-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617346494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346494, "uuid": "1f886e55-de12-4c8e-af4a-67c368ad74bb", "comment": "Malware payload (Gozi)", "value": "9b3660cfd9222dc9578f6a043df71d45", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ifsb", "colour": "#50DF42", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346494, "uuid": "d3e8d762-dcf6-4e12-a06e-c64a517b4d74", "comment": "Malware payload (Gozi)", "value": "6809a349ecc7338f432408e18a99c051baea71705ca97e3b5274956ebef91344", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ifsb", "colour": "#50DF42", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346494, "uuid": "2029a0d3-2863-478d-9b32-7a43e83e1f24", "comment": "Malware payload (Gozi)", "value": "b30ed4be4cd7c89a30fc058357d3aa1dbb3e0425", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ifsb", "colour": "#50DF42", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346494, "uuid": "5b2fc6a2-b9bc-4efa-9fdd-c552d63f7145", "comment": "Malware payload (Gozi)", "value": "5904b15a80ff0816dcb8412407f4d0b721c3d51b4db7930a05064550b7e44c3c060646a100d58675ca59fd6a82998353", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ifsb", "colour": "#50DF42", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346494, "uuid": "908afeff-7b10-4f41-a49a-59a77142babc", "value": "F054C0013AE8C9B2D3D91AB64C79E679BE1CECDD3832651326ED3F9C3CF92052815586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346494, "uuid": "a189a570-90d3-49e6-be7c-3c6060e46247", "value": "9778e49db4c43ed1461ebe36f0588a5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346494, "uuid": "4738ea27-e18c-4c9c-98c7-2eacc7538ac9", "value": "1536:r22kzZMdS66pAFxIl+YkSVoZlP1usBVEzknoxJasJeW636cz92ZIxC:OZN6AAFmSSkfBWk9xxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617346494, "uuid": "7040d6db-4c94-481d-9180-a6b98979a304", "value": 291928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617346494, "uuid": "d0ac1bcd-47a7-4a39-b4ca-05e2d86f9430", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346494, "uuid": "2fe1d359-7c67-4334-b06b-cdd8f27b6baa", "value": "kitten-weiss2020_com.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6795276a-934c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617324192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617324192, "uuid": "5cb9fce5-22da-428c-b3d7-e444ebd4a8b9", "comment": "Malware payload (Dridex)", "value": "944b609d5125ae25c7334a2ad5abcc95", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617324192, "uuid": "6bb6a3f7-b87e-4d1b-b9c7-ccabd1f14c47", "comment": "Malware payload (Dridex)", "value": "681e0fd57b2fb0b388a78c2661c4d1c4d192ed0547144c7e1caea0d7f024b658", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617324192, "uuid": "d51bdc76-4ec1-4822-8a73-cd6e9b34a91c", "comment": "Malware payload (Dridex)", "value": "4f7b0ae909bf6f6b91c283bb0c000c4161f8a4b4", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617324192, "uuid": "a2be970c-737f-4366-8444-44e026d12660", "comment": "Malware payload (Dridex)", "value": "80c46259473f8530c4632931f648c5991f68b1b771cfb77c986eaddbeca10c84ea799dd1b65a31e17b74b07062e0f7f0", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617324192, "uuid": "5bb0c060-1030-42d8-8e00-52f99bc6423b", "value": "8814BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617324192, "uuid": "3613a31e-2f4a-4874-ac95-78008d7e139c", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617324192, "uuid": "beaf176b-a57e-4ee4-a592-94bf10236c7c", "value": "3072:Dopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:EpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617324192, "uuid": "02ebfa9c-32de-4ea8-aa65-e5b5bab205eb", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617324192, "uuid": "67da2c21-3d0c-4953-ae02-b70655abed67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617324192, "uuid": "e6bfc9af-7a00-4c3e-a4a9-2d6491c2a9e2", "value": "681e0fd57b2fb0b388a78c2661c4d1c4d192ed0547144c7e1caea0d7f024b658", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f610e9-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617386554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386554, "uuid": "3716ccc3-aceb-447e-a636-02f89507ec5b", "comment": "Malware payload (Formbook)", "value": "0960c660ac08dc69e085d066f71f68fa", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386554, "uuid": "ae828b84-04c0-4604-b945-84080b6ef2b4", "comment": "Malware payload (Formbook)", "value": "6878e1b95116d026a4e76c4e8130019f12391307af78a7efe50ce01eebe8ee3d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386554, "uuid": "d480b102-9f55-416d-8c61-d0c928363edf", "comment": "Malware payload (Formbook)", "value": "b5b4e0cefcdd8c093c5657a72ba094590d0ee4e4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386554, "uuid": "74ab873c-9d34-4ef3-a55b-787b334dbc5d", "comment": "Malware payload (Formbook)", "value": "946d845131fe6b1324243d97b71149f4d27f602c2b4adb9fdc2f6dd5f9c7e430df618febaf79a43111cb2856d462312b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386554, "uuid": "9525e357-9ccd-4d86-ab36-1c194d385cf7", "value": "32845B823144DCDAE04329F258AFD57061787D9E8164C60E3783BF2BA5E735224AF79E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386554, "uuid": "2f9cd8df-4ee1-43bc-958d-e7c89b009199", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386554, "uuid": "23aceaab-fc2b-4e7d-bd62-d03464024fa0", "value": "6144:v9X0G+stvLGtELbMUTKZ6N1bppzvj5F74Xp9/S4TOHMpitHGh0u:Z09SityjKUnJFKp9abMpQHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386554, "uuid": "d2c7163c-183f-4f6f-a083-552a99e1fbf8", "value": 401858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386554, "uuid": "0324cb2e-1f60-4522-8663-bc8ab910a5f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386554, "uuid": "4e8eb676-e601-4b8f-ad3c-f0bde8805cd0", "value": "OC CVE9362 _TVOP-MIO 2(C) 2021,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6821316c-93b4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617368861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368861, "uuid": "110a3508-4529-467f-9fb9-8c1af6efe48e", "comment": "Malware payload", "value": "7f7f960a7655fd84f966c733901e30f0", "object_relation": "md5", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368861, "uuid": "b4440dfc-d713-4a2d-89ea-1771ee9db32f", "comment": "Malware payload", "value": "69696a18c86f50a83abad03fd6731810344b5527debe6574ac25e773e39c3210", "object_relation": "sha256", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368861, "uuid": "42487888-8846-47e2-8330-ccb55790625c", "comment": "Malware payload", "value": "19bc5f4c36404ae83e31e528dc80f99a527ae612", "object_relation": "sha1", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368861, "uuid": "c74903e5-4db7-4fbe-8f18-55d02bcae50a", "comment": "Malware payload", "value": "6d654c4e271d0c835fa6af65bab274b59b0683f3f97855d5e46c4e57558ef18bb0c12fbe6155b828b4da86b33e7802dc", "object_relation": "sha3-384", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368861, "uuid": "562c7c4c-7196-45a6-b0f3-cc74b05c52bb", "value": "7481730A573E3CA586C302E201DE8BFCF1A24D998348777BA8693A53744293FD84933D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368861, "uuid": "3b34c5cc-a2c3-44e4-b896-8284a5c90289", "value": "96:/cFYPJ+fE2QRz2HOp/3u7DAB515najUHB4tidoELo:/ccJ+Mhsup/3u70l5n8UHCwoELo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617368861, "uuid": "f5231f28-633c-4bac-9e3d-4129014e7601", "value": 4166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617368861, "uuid": "f9559e30-65e3-4617-bfcb-8fab39bbdd1f", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368861, "uuid": "5a12ba7c-3aad-4ce7-ba80-c512b0fe0442", "value": "yMrSjZPMmmvU0VD6Qudi2.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dcb677c-93a5-11eb-abe1-42010a9c0039", "comment": "Malware payload (CobaltStrike)", "timestamp": 1617362482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362482, "uuid": "9aeed68f-83d8-44f4-bf70-1ccf0bae27cd", "comment": "Malware payload (CobaltStrike)", "value": "db9214c2f8340ceba664800481f0ca08", "object_relation": "md5", "Tag": [ { "name": "54.75.3.205", "colour": "#0AA738", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362482, "uuid": "16e5614f-4059-4c89-aca7-5ef6f0ff5fc7", "comment": "Malware payload (CobaltStrike)", "value": "6afab1df3de00b1200198e692eae6dc36373c310cf4102ecacc5c6e8ff89a7e8", "object_relation": "sha256", "Tag": [ { "name": "54.75.3.205", "colour": "#0AA738", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362482, "uuid": "89cd3687-9943-4e8f-b144-8bfc3fa248c1", "comment": "Malware payload (CobaltStrike)", "value": "8c5a737481b50108e16f2494a3621901fc59a367", "object_relation": "sha1", "Tag": [ { "name": "54.75.3.205", "colour": "#0AA738", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362482, "uuid": "efd23bff-f94e-4b6d-a528-5eb9742a6eb8", "comment": "Malware payload (CobaltStrike)", "value": "c2c109a6c7fb4a7ebd63329bedc57d6f66abb5c17054ecf4b8bae78c507bdc84f5bab5dadf30171bef37bd736e887272", "object_relation": "sha3-384", "Tag": [ { "name": "54.75.3.205", "colour": "#0AA738", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362482, "uuid": "454035a2-c6f8-4fbc-ab2a-bc4931723f44", "value": "2324DFF5A60A5ACDD8267D75E8E4A5A09F26FD3F7A0EF22C9EC0800191C31DF075A784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362482, "uuid": "c1fade1e-d746-4026-b907-ce3aee02510a", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362482, "uuid": "df83589f-e8f2-4209-96cc-3a3cb585dd20", "value": "3072:Z1s9brqJYqUkOVXfF9ffI0bKuAjYRZZczSvj6HtAkfxIKdckUDjAuSUp1Bj:Z1wKokOVXDI0OuAs76SCAp1SAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617362482, "uuid": "a9f0c258-91ac-43ce-9527-5f7569aa637a", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617362482, "uuid": "90e1d16e-1746-4d76-9ac8-7c47192d79a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362482, "uuid": "80ec2496-db7d-45f5-bec5-023b9e7adf0d", "value": "6afab1df3de00b1200198e692eae6dc36373c310cf4102ecacc5c6e8ff89a7e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec100b97-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617386692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386692, "uuid": "ab7435fd-4b89-42a6-81a9-c082d26e0419", "comment": "Malware payload (IcedID)", "value": "1d571b13c090b1d12258f643b8253141", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386692, "uuid": "5a5190f7-3892-4e32-9892-472b0de3a558", "comment": "Malware payload (IcedID)", "value": "6c23dff209bdd1af834918fcdbaedfd6dff939d63cdeae6c81abeb3f92e7baf1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386692, "uuid": "71cb372a-04ab-45ba-9da9-dfdd2e91ddff", "comment": "Malware payload (IcedID)", "value": "449e5a55a7d7092143e49da1dfd34291f6479662", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386692, "uuid": "bf5d883f-f1d2-4b14-97b5-26e1fc14aa9f", "comment": "Malware payload (IcedID)", "value": "d874158656a75b399aaea2a838bb169ff88ae4b46af068426bfa1981e541d03c194f148d167d95a064358b6b7b12debb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386692, "uuid": "712db613-39e4-47be-afa3-da5edae9eb64", "value": "10935DCA05700B22D5365672C5B31B28C27BFB40B7D368FBD19C7698C5C2180D772DAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386692, "uuid": "5eebd86b-f6a5-48c5-91aa-64137697b17e", "value": "768:RHppffnqCuZgKEq2OqmBhw9+eyA/Dj74zZ/mgxH7Wgagg1nXFJBMq/umJUZp:NDqvHEbsBneyAbniZPWznfBL/nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386692, "uuid": "0afa44de-1c20-4ae5-b6b4-16289f77f4e6", "value": 92911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386692, "uuid": "68d41819-a66b-4ed1-b11d-af6e31097619", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386692, "uuid": "10819e5c-ba88-4441-bc90-640296d514f8", "value": "1d571b13c090b1d12258f643b8253141.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02afa278-93a4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617361819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361819, "uuid": "d4504b1e-5fdc-4cac-b2fb-51f9fbce1478", "comment": "Malware payload (AgentTesla)", "value": "a82bacf40c984316b473f7f8e3138785", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361819, "uuid": "3347db9b-e0bc-4093-b20f-756f30226c93", "comment": "Malware payload (AgentTesla)", "value": "6c655d9a02c5fce292ffe757bc255eb848327639e5d77829741bf29d477485f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361819, "uuid": "ba97aeed-7d26-4c0f-a7ef-e3455983aa4c", "comment": "Malware payload (AgentTesla)", "value": "45ce5209bf935d417178e48e0727dd0a5864cf7e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361819, "uuid": "a9c5b651-e53e-4a37-a358-c8516fcd8602", "comment": "Malware payload (AgentTesla)", "value": "6578c8f09e9834ca2e3b1a9b6731923402ac1c01bd2b94569605e2c106d0521d73750c2313e63974bffb7070923683d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361819, "uuid": "e94386ca-2cd3-4971-b5a8-bbaffa32f52d", "value": "AFC4DF18E7AC4B0DE17E57BB807033343FF9A0959652FF89EED110AD29636818562B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361819, "uuid": "f370fc17-c310-451e-b52f-5b299e424ebc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361819, "uuid": "3f6c3c7a-90bc-48b6-887a-5ab97383bc32", "value": "12288:s7IkouJnJVBwkZyOZhceNq7Z4RkzefUF9ttpQrwjfQW:s7NvlMO4qqN4TI9ttPjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617361819, "uuid": "13b7c571-56c6-4fa5-967c-05eb3c65b5f8", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617361819, "uuid": "8403c8f7-7bda-4bd7-b93c-735b27984da2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361819, "uuid": "33834180-7ce4-4c36-8082-97604aa1a5ef", "value": "balance payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afd2b68-93ae-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617366343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617366343, "uuid": "ae38fa75-cb97-405d-b53c-0efd37abe430", "comment": "Malware payload (IcedID)", "value": "48fa48c6e9f1c2a704089da688bbf95e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617366343, "uuid": "31bc8167-85a4-4c06-8331-89dfd655bde5", "comment": "Malware payload (IcedID)", "value": "6c932d3c78cedf8a31df6035bf8e4924c3cd67b899f70209af67ae5f6e215624", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617366343, "uuid": "a0331293-b49e-41f6-9617-821c9ca21d98", "comment": "Malware payload (IcedID)", "value": "8a03ebe9b44e8f0a1e3bc97eaa72a35afb38b021", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617366343, "uuid": "7e94ed6f-be1b-4d55-bcd2-8af98520330c", "comment": "Malware payload (IcedID)", "value": "9cb241353754105981d653ffb9f0b87743f62cbdfa3fe935222f12b8f61b1c08a5d9ade4faa69cb9217341b846ea1eec", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617366343, "uuid": "c2f14f2d-55fd-4580-b8ae-cae9b5a3c702", "value": "0414F7935CCFB663D42F50F1A8A1547D7F30BCC413E297DBA9084B1AD993792A972318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617366343, "uuid": "0d0c6529-3613-445a-b389-24492e51a74e", "value": "3eb5471c5370e4bcb3be6637e4995a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617366343, "uuid": "5d551bbc-288c-44aa-8915-1d0cc91f11d9", "value": "1536:Vq8ByBeZnwLGM+NoV1XjeNSaziIz7Ja5j/Nj/IXoZcq+M6qaCZZtr2wS+FJZLT:Q8+Kjv4RECZnrDSGZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617366343, "uuid": "caa7a213-6b9a-499e-9dd3-13040963fc03", "value": 203808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617366343, "uuid": "90f8bd42-c9c8-4cf0-83d7-460137f29066", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617366343, "uuid": "5a2f79bc-ece5-4e41-b4e9-6a9ec1a867df", "value": "44285,5327891204.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0cace86-93a4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Adwind)", "timestamp": 1617362111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362111, "uuid": "e8b1cee0-f7dd-455c-9b16-170814e1a9b5", "comment": "Malware payload (Adwind)", "value": "6822c5a7e742be8eba1a4b6266cd2f8f", "object_relation": "md5", "Tag": [ { "name": "103.114.107.184", "colour": "#1DFC7C", "exportable": true, "hide_tag": false }, { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362111, "uuid": "a1efe9c5-e577-4bb0-a7b9-20cf9a82294f", "comment": "Malware payload (Adwind)", "value": "6d8c96bbe09e6d729ae7be19122aba85769caa52d4c994b9379fbc3e498f74f0", "object_relation": "sha256", "Tag": [ { "name": "103.114.107.184", "colour": "#1DFC7C", "exportable": true, "hide_tag": false }, { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362111, "uuid": "3d8b0869-9c89-4077-bc20-535063b7b213", "comment": "Malware payload (Adwind)", "value": "a39691cbe51d6e023e7dfcc23d9efcefdab25f2c", "object_relation": "sha1", "Tag": [ { "name": "103.114.107.184", "colour": "#1DFC7C", "exportable": true, "hide_tag": false }, { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362111, "uuid": "e63fbf9a-481a-4a0f-b5a0-da923cbe1513", "comment": "Malware payload (Adwind)", "value": "f15443b0665c053ec2fbaac8c1f0117315a35b146bac0b34ed65008fd7e90daa525e2a165a66afe9d6575e55b4ddf1ad", "object_relation": "sha3-384", "Tag": [ { "name": "103.114.107.184", "colour": "#1DFC7C", "exportable": true, "hide_tag": false }, { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362111, "uuid": "ca634f70-7314-4dfc-bf4a-249b1ce063ab", "value": "9B15332F9603D95D801D43B1E21457C53B43A33605A98B57BCBBA42CC189EDAD32B7BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362111, "uuid": "cb7ba311-b8f6-44af-b2ab-7d878c2f82f3", "value": "24576:gplDv5CmhOflZ/Y75PNSToH4+KbwOX4KnR3HJTcNGODKp:gplDv5Cmsld4BH4+KbwIJnR5TGGODKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617362111, "uuid": "bce4ca71-7dc8-4873-b769-81ede55b9fbf", "value": 912042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617362111, "uuid": "eae506b1-b525-4364-a99d-863fa1ff1c59", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362111, "uuid": "42c2ab58-93b4-4661-b01b-07e2c40992d6", "value": "SKBMT 29 JAN 2020 at 1.70_BB3243_PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd357a9-93d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617384336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384336, "uuid": "15e01c16-420c-4f9f-9476-5aca7d1ec527", "comment": "Malware payload (IcedID)", "value": "c22124f0ff1aa284e6ed12a895d427f6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384336, "uuid": "0f39de69-eb72-4707-b361-e080cbb36e42", "comment": "Malware payload (IcedID)", "value": "6eaa904c3bd46870bdb533b8dc9cb7953bfc0c23ba49ad87bee84b6092f8c27a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384336, "uuid": "ed99ac0f-8d6a-400a-84b7-329b044afd72", "comment": "Malware payload (IcedID)", "value": "63774de58ec7bee3c1752c75182322903f75e4a4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384336, "uuid": "d6eba870-e2b7-49f1-944a-52bd26a018e6", "comment": "Malware payload (IcedID)", "value": "a9818c2ca06cb4b42579d9a5f176d2963c474833e29cf21323941ef06e374b4e41ed66d8346e22981813aba70a598e11", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384336, "uuid": "08fc293c-f42a-4002-9fb3-6f392ec4c2df", "value": "72530A8947503C91C0FEBD34F3A69A58931EFB30AA8F47B794C46BBAC47B5409723619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384336, "uuid": "d5153319-df5b-4359-9823-f90acec52aed", "value": "eb10ff98c4adb7472a591c82bd2ff673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384336, "uuid": "5e5e5f7d-7209-4d8c-b52f-aa10feb94c41", "value": "1536:caCAzXz8T6rLXah8lI+Idu+B3XbuF6dRiF:n/gTkXayetu+BbuUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617384336, "uuid": "f4e45d88-bf1d-4141-861f-46040c6027c6", "value": 65568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617384336, "uuid": "b628a9e3-2ad9-43d3-b78d-bc1c8c6a0167", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384336, "uuid": "c26a454d-b143-47ca-9bbe-c19125edbea1", "value": "c22124f0ff1aa284e6ed12a895d427f6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7176bf-939d-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617358859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358859, "uuid": "59751c03-5f3b-4a7f-96f2-32ed27dcb4a4", "comment": "Malware payload (IcedID)", "value": "b291ce924a99d3719cdc485e0cd0115a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358859, "uuid": "93c0abf0-c5b7-4b08-8519-de54118a7fba", "comment": "Malware payload (IcedID)", "value": "7117fca67d5e13cf9bded6b30481511c99b132b05993bcb68578daf5dfbaac7b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358859, "uuid": "61ea24b9-0e23-4c1d-9269-9da77822a41a", "comment": "Malware payload (IcedID)", "value": "e5a7eeb9baa4bd53ed54fb3588af1168643c171c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358859, "uuid": "f3bb3745-cb60-4fd5-88f5-9cca8f52c703", "comment": "Malware payload (IcedID)", "value": "c6057fa3dff96b90159b1127c53450f5c02fd777b7d8548472c9aa88b3a6ad1197347db6e371eb990c5e0928f8d7e967", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358859, "uuid": "ef0b6c5a-d3ad-45ea-846e-99e41314372f", "value": "A8939DEDE907F4D2CA158F7C4D12758920BAC4A6265FF007709A622F5D22F6C095F2AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358859, "uuid": "0430d921-75c2-4e9e-9878-5fe29fc61b4f", "value": "1536:AB2xe0FM42S2hawdIVseTSV7SaTe8NDUYl+LrHtlmuzx2ofDg:m2bMcMpnSaTDDFysE2obg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617358859, "uuid": "88520cf8-df42-402b-8c28-99afe81fb69e", "value": 94801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617358859, "uuid": "a7493ac1-7ad1-4aca-bf6e-710e70c804df", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358859, "uuid": "c6a956f2-6ac4-4874-86fd-ae323d0c2a43", "value": "documents-760030714.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04a873f-937e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1617345762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345762, "uuid": "d9241053-ec1d-4e5e-867e-d30a9f335b0b", "comment": "Malware payload (AsyncRAT)", "value": "67715ff5ade0c275a08ffb56ce22b883", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345762, "uuid": "709e8b7b-4f9c-40bf-822d-6318b271547e", "comment": "Malware payload (AsyncRAT)", "value": "71c0b8d8cee53234eef68f38f170f94aba5cfb340f629310ffaefc736bc975f2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345762, "uuid": "b2dccc0f-a318-4af6-b83f-19a32cb0209c", "comment": "Malware payload (AsyncRAT)", "value": "bbfbc246beebebc499237f771aa70aaaa3b50862", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345762, "uuid": "c927072c-93d9-450e-a6bc-5e83378fd23e", "comment": "Malware payload (AsyncRAT)", "value": "f9984ac52db92344eb3f15f87e3d911a57d64f32c2d7b8851c43ce03bb717c32cfe9f3f7586a60d38008d2cb7aeb4d19", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345762, "uuid": "54bc19ae-709b-4ee7-864f-18fb0e0919c1", "value": "C30412E15D00CBE0B4A44AC4FEA22381F5A782CDA23C613579A9D6016FB97637CFA534", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345762, "uuid": "173b6f2d-4d34-4d61-bb3e-cc902762a61c", "value": "3072:WAgDVxB6ySWuqEgrRQbTLyvgf2z8NSb157mJbbNaw6Q8uGFSKu4WL+eVPyTlL8nT:WJDHBrSAX1Q/m42gNe4HNP6Q8eKuNLlD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617345762, "uuid": "ff743f13-3fb8-4166-a059-8dda2720c197", "value": 175297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617345762, "uuid": "eb92c429-7580-499b-9b2e-1713791a6243", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345762, "uuid": "f2688476-6bcd-4f93-bcc1-54b322e42703", "value": "Swift _Copy 3169777.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367e5f6b-93fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617399702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617399702, "uuid": "6138aad8-ee78-4653-8638-5d2a5d18ffcf", "comment": "Malware payload (Dridex)", "value": "8cc89d1fdc84e30f1a010e3b80d3c1b4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617399702, "uuid": "016400e7-b193-4216-8dfc-6cb8c4c70f5f", "comment": "Malware payload (Dridex)", "value": "737e6d51337e9edb639791fe2c095040f3d34a293074c1e338874a643a1c2b7d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617399702, "uuid": "bca52fcc-0847-4f43-87f3-38525039b6ad", "comment": "Malware payload (Dridex)", "value": "ccb8d2d262ef78434e73ee330f8ec1b8afe66e9a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617399702, "uuid": "7580d396-66b0-4dea-b5c7-095e4362aa8a", "comment": "Malware payload (Dridex)", "value": "ec1ef010a8b1001f5a6e7f4ac736d901efbe5f8b73bd34691a3db50d4eef830c3fbe95f951233597f0c8a165731f3fa0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617399702, "uuid": "439ade86-7efd-4064-bea5-24daf149aa7c", "value": "D214AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617399702, "uuid": "534ca808-b4c2-4dcd-ab81-1ecba36785ba", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617399702, "uuid": "2de5b27f-2ce5-411b-b9de-c3e8a2d0498e", "value": "3072:41i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ki78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617399702, "uuid": "98a281a7-c13f-4a9b-a3ba-6eb15cbfab9f", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617399702, "uuid": "9c271cd6-7bc3-464f-98d1-6db8e9536e21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617399702, "uuid": "ada18617-2139-4e73-851a-63d4f076b41c", "value": "737e6d51337e9edb639791fe2c095040f3d34a293074c1e338874a643a1c2b7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183bc12f-939b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617357990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357990, "uuid": "45079614-0d32-4e20-88a2-4376bccebf69", "comment": "Malware payload (Formbook)", "value": "0fbe4dedbd8d6257dd0664a6a04c2ac8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357990, "uuid": "4fbeedbe-566d-4de7-a82f-832ff497ff09", "comment": "Malware payload (Formbook)", "value": "7383d47bc41a1a4c7111e98a788312283289d7f514ad0505f85f24012179927b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357990, "uuid": "cb6cca0d-6a70-4609-9ff2-7243f4bc6b01", "comment": "Malware payload (Formbook)", "value": "463da896bde07c4f5073dbab283abb7cfc3106bd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357990, "uuid": "a4dff942-0fc5-4043-a26f-595ba9461bbb", "comment": "Malware payload (Formbook)", "value": "3b0f93d9e6ec2b6370ad6e61a12edee6c1b9aed1551c54a3c25bb3277060da4906de318b56490e24c42abd15341078a2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357990, "uuid": "6086b263-c7c7-473a-91c0-a919b4be43c5", "value": "35B423497378371EE60B4479A1665DE3A2DD812F466E62CB5901EACCC3B3327D2E40CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357990, "uuid": "9fbdfe34-1d65-446b-b9be-17c94db8a67f", "value": "6144:gIJfJqCSLAJ9RW7maPfLRiayeHFUzezEJwY/X5u3UMEnFQWkSbZxXl7QSymBDV/:goJqCSSCnLosl3RKaYnW6TXl7QSRh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617357990, "uuid": "c6173ea0-2747-439f-8d51-53564166468d", "value": 506421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617357990, "uuid": "72b043ae-b517-4ca1-b9cc-59720335bdad", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357990, "uuid": "094f748a-65fa-45fb-aa0d-6734f04f2a30", "value": "QUOTATION REQUEST.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3bdb467-938b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617351352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617351352, "uuid": "fd11d896-457b-479c-882e-6a53a19755e1", "comment": "Malware payload (Dridex)", "value": "c9174e507dc426a1ca0fe3b5a6b3817d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617351352, "uuid": "178e8ffb-1d6c-495c-826e-3b759542c824", "comment": "Malware payload (Dridex)", "value": "7494bd34a465dac29f76baf7c75db8d825e82481480577c8ece0ebd2b3c5c3f7", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617351352, "uuid": "ff96f497-019f-49f8-9ff0-8d2197ca1452", "comment": "Malware payload (Dridex)", "value": "662a2ce69ec6378f05d2bcf6668989ca4171ed6f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617351352, "uuid": "fdd9d8f6-e001-4ded-a8be-acd68d2aab65", "comment": "Malware payload (Dridex)", "value": "1446bc84d99bb9d0d21fc8f16107bbf329986a71d82c7332754b9e3372c651d4384941ed2b13c2ab98070452e5dba972", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617351352, "uuid": "909d7d78-d374-4770-aa80-eb0cf79e7295", "value": "8314AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617351352, "uuid": "86739ff4-d0c2-4316-b47a-0fa6eb950651", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617351352, "uuid": "10319497-c10d-483e-9dc5-8114f44a792b", "value": "3072:l1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Hi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617351352, "uuid": "95e80817-e483-49ad-8307-c7a547a9433c", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617351352, "uuid": "33fd76e1-0b25-43bd-b95a-f8392b21b1d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617351352, "uuid": "5dffe247-4002-4120-9b00-fda4f1fb2cbd", "value": "7494bd34a465dac29f76baf7c75db8d825e82481480577c8ece0ebd2b3c5c3f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340b7f15-93c0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617373928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617373928, "uuid": "99a79262-e69e-4764-90e4-7de35d6be098", "comment": "Malware payload (Dridex)", "value": "f25b617d745f6045eeab7d6c64abbd2b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617373928, "uuid": "4107d787-6a93-426c-b356-f970a063ae9c", "comment": "Malware payload (Dridex)", "value": "74cd1d289fdf3887db5d02ca9f3b76dc857cf99c7554440bb8d94bb8ed10afc3", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617373928, "uuid": "92f6ea12-23de-436d-814b-5e45c7dfcbd9", "comment": "Malware payload (Dridex)", "value": "8b976382bc0f9da5f32bb0efaa735828f70d9fc5", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617373928, "uuid": "c7a3efc9-fa15-4dc3-bfef-e920f01cb73f", "comment": "Malware payload (Dridex)", "value": "0cb7df183473e64c3e7a3684bae6308f8f3587f5099f0113b50064517c30bac5e5ef29659bf1719be8248813928898f6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617373928, "uuid": "88e5a368-c20d-4ae1-8804-3050bbb4f5c6", "value": "9014AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617373928, "uuid": "90332722-7442-49d9-b7f1-fcc2e1da321f", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617373928, "uuid": "861041fd-3ec7-4e20-8826-77f4cccfd229", "value": "3072:p1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Li78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617373928, "uuid": "292c0d6d-ddb0-4927-985d-3ebf38df97de", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617373928, "uuid": "426f5fd2-85ff-42bb-9b99-a2a11c0b4275", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617373928, "uuid": "3d0cf567-8f42-4e27-a488-d4c6e7c88023", "value": "74cd1d289fdf3887db5d02ca9f3b76dc857cf99c7554440bb8d94bb8ed10afc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed82c43c-939b-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617358347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358347, "uuid": "ddc0b5c6-f2c6-4443-8778-5c67ab4392b6", "comment": "Malware payload (IcedID)", "value": "de21d72ebac7d3703ea285b9a473e381", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358347, "uuid": "ab6dccf0-31d6-458c-87d7-71edde3213a1", "comment": "Malware payload (IcedID)", "value": "750491ad35aa3e5b1d2dd346c7eeb30cf166df7cf34fd854c9c22bd581e06e5f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358347, "uuid": "3a86be99-b7f2-44cc-a4b1-e275c58e6ae4", "comment": "Malware payload (IcedID)", "value": "2f0750f1797e719a4ce0b7dda6cb25c58a9796b4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358347, "uuid": "812c1dc2-4970-4c39-acd0-454db65d2af4", "comment": "Malware payload (IcedID)", "value": "67aba5d3a57a4c1fb47600367080cae3dcae4d4c6ca9130c6af5aa2fb5c247ab2abedca62bb3c3f597c349d445a1640b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358347, "uuid": "3e9e3375-1c46-4b4e-9640-c309e9767ca8", "value": "55B3298D6B907CA1C0FDBD34E3A19698821EFF309A4F47B794C5AB79C0AB5409623749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358347, "uuid": "863e7d55-7fc7-4bda-a186-4c1a2ce009e5", "value": "eb10ff98c4adb7472a591c82bd2ff673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358347, "uuid": "5fe863ff-59b9-4fb6-afe6-a234dd880697", "value": "1536:fmXIFRBSvf0EW6SL504jXnk1Nzva2Xj3108/l:dbafVsL504jXk1RvlXJdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617358347, "uuid": "62003037-cdc2-4086-b455-a525384ca5f4", "value": 110599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617358347, "uuid": "a5be5117-1979-48d5-bb36-031ea079ac5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358347, "uuid": "14c0dec4-1b05-4f70-b43c-6c1231f56314", "value": "0104.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4837e9aa-939f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617359788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617359788, "uuid": "dcf02209-c29c-437b-86e7-2d0a06288083", "comment": "Malware payload (IcedID)", "value": "dc9ce066c471b34cbf95e813214746c5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617359788, "uuid": "2d8d8510-a511-45fb-a800-99428c68d66b", "comment": "Malware payload (IcedID)", "value": "7510b00f9f1c4405a79345d96614fef332cf1ee36c636b3301b11bac8cb6c9e0", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617359788, "uuid": "8d9eb236-e897-4e83-8a8a-57ea8e24c3f9", "comment": "Malware payload (IcedID)", "value": "4fe8cb46da0584561483ad26fd5d83258fdc4835", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617359788, "uuid": "7289ffdd-fcfc-4f67-a8e3-85e8c63c6caf", "comment": "Malware payload (IcedID)", "value": "d44e24935072e65ff3f4513297cbb3561af991f3ccde2e242e9f195c29174b4e80929ba0d9fffe2c98348e6d4df5b7e6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617359788, "uuid": "5691dac3-16d6-4948-b043-fc78afa82d54", "value": "34939DEDE907F4D2CA158F7C4D12758920BAC4A6265FF007709A622F5D22F6C095F2AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617359788, "uuid": "613f5da7-e66c-4320-96ae-74e9f7ca45a5", "value": "1536:oB2xe0FM42S2hawdIVseTSV7SaTe8NDUYl+LrHtlmuzx2ofDg:e2bMcMpnSaTDDFysE2obg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617359788, "uuid": "c2d1ece3-65d3-42e9-8ccc-da4ddb44c1ff", "value": 94801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617359788, "uuid": "f57ec183-a148-48f6-b306-49651e01a434", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617359788, "uuid": "6f093fd0-8f8a-4a7b-96c3-2d68826ec24a", "value": "documents-1987093434.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea346165-93b1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617367791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367791, "uuid": "36f46333-940a-40ae-8594-44a9865eb1e3", "comment": "Malware payload", "value": "1209611f5ace2e9d4fa4cb8a92cdd3b4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367791, "uuid": "d7a8feae-6102-45af-bb47-58a00baa0ec8", "comment": "Malware payload", "value": "758b3b8719febb49466a00e876b0762595981083eeac8b979fed291167461af0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367791, "uuid": "eaf1588c-5c39-45f1-99ca-bb8802dd4efb", "comment": "Malware payload", "value": "ab6ecd2a36adc5e43b1a1c833cdbbe84ac7f22a3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367791, "uuid": "38d39e51-ddd7-447a-ad65-7e3abc5ef395", "comment": "Malware payload", "value": "286057a2babd00a21ada3dc35235a90649db1ca076593a14f70b3d9d98c13687dffac8c46ce7decb9fa080a590b2b952", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367791, "uuid": "c3442e42-4ceb-4ad9-bf90-04b85029188e", "value": "2C2349B089E521C0F03692772DF92657E9643D1DF72A8E9F90847E44762A6F03236B5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367791, "uuid": "d3a6120a-f360-41c2-a159-865b500dbdba", "value": "899ed385f326a8d1a9ab31e32ad45491", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367791, "uuid": "9c9388c9-3416-4e90-aadc-3bbe7ae48b3c", "value": "768:nKizmGMOsCnfH8OiFEcn4HA6r5gWMuwVVSxapVt1s7+4FGAlFR4lVB:nKiiHCfHVYEc4H/r5MdVMxU1i+4kAlUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617367791, "uuid": "a78739a3-b43a-4b5f-9260-27013e8b6091", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617367791, "uuid": "9c9a8bb7-7cce-49e5-a717-1d38a15e1f9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367791, "uuid": "60cea65b-47a2-4a78-b610-9ec65b151fbe", "value": "Ajsueywp32.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84c2eb2-93d5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617383169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617383169, "uuid": "d48d8b75-9774-4176-9a99-6a017761fd1c", "comment": "Malware payload", "value": "da67b8dd072d1313fc8a82f2b9683103", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617383169, "uuid": "f465381f-19c2-4b8b-ad48-a4c7ded908fd", "comment": "Malware payload", "value": "768ea597d760b5748bf05f48e81ba41b91a49f3943a0269c868b716e92dd232d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617383169, "uuid": "9fbafe99-1085-4fb5-aed9-c702c8264a31", "comment": "Malware payload", "value": "d9440db3a76c7f122efbe7d6cea9365d8438706b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617383169, "uuid": "02f3de1f-c3dc-402c-b311-df0c748d7233", "comment": "Malware payload", "value": "793923b9156e6aa39ae19382556240069fe3864915aba130914e3d10fb152a14bf5e8afcf1e9fc7b317e677b7abdc614", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617383169, "uuid": "9fbd0bcb-00eb-4c40-8223-2ad65cddb7a4", "value": "2CE4C033F0C2C07ED0321032596CEB6259BFF9320A25499BA3C4156E9FB57D29E3665B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617383169, "uuid": "c01993df-5ad5-4a94-b18a-31378afc771e", "value": "2a908babc5cc3af850e078751d7de0e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617383169, "uuid": "13634570-25e3-4ecb-9222-cfeb58475178", "value": "12288:VoJqNIPtNmO6IOOEp0TMlja7NRl2PSVikIyoyueh+AkHcnLwuukoCOD6zl5jOz+2:VoJEKZ6IEGTMxapRl2PSwHTehy6B6+p4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617383169, "uuid": "cdb80b28-31c7-4e02-b962-027a0ca20660", "value": 698280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617383169, "uuid": "373d79b9-a3a6-453b-aa7e-3c079eea1b9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617383169, "uuid": "cfd94343-cc29-4cf8-8ade-c7d08dcdb683", "value": "sorano.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f5a254-93c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617374904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617374904, "uuid": "0c33de1c-591d-43a7-abff-a41c0484236e", "comment": "Malware payload (Dridex)", "value": "2a425fc93877c1112e3b660a89b227c4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617374904, "uuid": "32c1e8d0-bd44-439d-8f8d-5d540dc8a8cf", "comment": "Malware payload (Dridex)", "value": "770409b1871eed6babe9a36c1eca06f8f17627819814f6acedfc19baa080ca42", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617374904, "uuid": "03ed0a78-918c-47c5-936e-039ed1daa5db", "comment": "Malware payload (Dridex)", "value": "bbfcc4fcbf0dc37cfe7e7b486540122054c3233c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617374904, "uuid": "ee5208b9-2a97-4894-be9e-9309ba191ed0", "comment": "Malware payload (Dridex)", "value": "ae4c5abb4a452536a2dbe6ce8bd885eeb49fb0bd5d0334d3d8f9ffdc39eb520ca8335bd00016eb895001d7c0f73ae828", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617374904, "uuid": "53cc631f-6fa7-4de6-abaa-9b485a359463", "value": "D1248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617374904, "uuid": "19427e64-b4b3-4590-a5bc-1f2eaee54766", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617374904, "uuid": "0a432f36-fd58-4b5c-8fc5-2e0b1cd24c14", "value": "3072:56TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:5oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617374904, "uuid": "9b092d60-4e66-4ab3-a8de-090ebc1b943b", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617374904, "uuid": "c60ec21a-b633-43a8-90f2-579a05f22693", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617374904, "uuid": "723d7c84-d711-4f8d-b75c-6d9387ec18a1", "value": "770409b1871eed6babe9a36c1eca06f8f17627819814f6acedfc19baa080ca42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4c7486-93b4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617368762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368762, "uuid": "6bdadcd9-e0be-4cef-8243-9aabb3851cc8", "comment": "Malware payload", "value": "e825ec4766b492beadaa515269960d63", "object_relation": "md5", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368762, "uuid": "1130967c-2106-4c8d-bc27-e6c1105c8bbf", "comment": "Malware payload", "value": "78710c49b37af00745534239b0d17c2e019a99f867492667592d131b77f0933f", "object_relation": "sha256", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368762, "uuid": "7eb6e8bb-519f-4e1d-9889-1551411e2f81", "comment": "Malware payload", "value": "a9c319bfbbf40475fe5e704454eb6d7779a40ae8", "object_relation": "sha1", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368762, "uuid": "a6fb3e6b-3853-47b1-92da-9e88d3e9c0a7", "comment": "Malware payload", "value": "8a96351691a9558165cf16dbde7792170d056af93ba0a2f1b9d4155d33b6f2b2bff5d31d2feaa4615d5bf67355a0c459", "object_relation": "sha3-384", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368762, "uuid": "eeed7d63-0eeb-4a97-883f-a49e25ec3197", "value": "1E257C027A48CD11C1A91636E9EF85184BFCFD417A26C71B7E9A376CA4113A3BD1D2CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368762, "uuid": "d62894be-b4f4-4bcb-a921-1f0dbe802305", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368762, "uuid": "2d10598b-e1bb-41aa-a6ae-968640cf99ef", "value": "24576:U2G/nvxW3Ww0tjEmi97OdbaepE8YzorI+k:UbA30LaOesk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617368762, "uuid": "a1beb1e9-b4d6-4c8a-9620-6cbc988df14c", "value": 971847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617368762, "uuid": "8aa2f398-7ebb-4f22-9627-c419a500184b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368762, "uuid": "0a265aa3-9524-4947-a146-8b5d2ad59b65", "value": "__riv_te.soft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef6e8d7-93ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617393085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617393085, "uuid": "0beeb79f-7bdc-4fab-bfc2-bc188e451ee1", "comment": "Malware payload (Dridex)", "value": "7e39b17289e4b109995a63f9939bcffa", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617393085, "uuid": "ad76c7bd-56e0-4617-a08f-8462f751a89d", "comment": "Malware payload (Dridex)", "value": "78a2a5c518271e2fb65dc6400acdfe64817c1c607c2d54e391561f6a8c295d70", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617393085, "uuid": "0fd36238-8d40-46b7-9eb1-7c802a65c530", "comment": "Malware payload (Dridex)", "value": "493ab69aa51b4d6fe600de9f530dc581b1e22340", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617393085, "uuid": "069be130-437a-44eb-a08b-1a6a35d0668f", "comment": "Malware payload (Dridex)", "value": "53a6d03bbe75928655e57ab4904e798c213d331a4987b9b95bd5f79e3850e1da14d24fa78f21d8c6023fb2970b22457a", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617393085, "uuid": "d1cab64c-4e26-4574-8166-a04608da113e", "value": "3E14BE4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617393085, "uuid": "5fa6b809-4cad-4657-8e42-96b735c1b694", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617393085, "uuid": "ffa29dfd-a695-4860-a49d-1bc9bdbd7fa2", "value": "3072:0opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:rpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617393085, "uuid": "af12da32-8df9-4d09-bf4c-6bc71b0b4025", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617393085, "uuid": "090a847c-307f-4be5-83b4-74babee35b95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617393085, "uuid": "34372ae3-25fc-4201-86e2-87064371e2fc", "value": "78a2a5c518271e2fb65dc6400acdfe64817c1c607c2d54e391561f6a8c295d70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e715d108-93ad-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617366068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617366068, "uuid": "f598a4d1-770b-42ed-a49e-01994913125d", "comment": "Malware payload", "value": "fe4dd316363d3631c83c2995dd3775f4", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617366068, "uuid": "d8904af9-be34-44e1-8640-73408e545ca5", "comment": "Malware payload", "value": "78b9d644a39f8479e1dfa7ac19e1f3bc66a2f3ea517727903383b6a365b8f8f4", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617366068, "uuid": "11a4e580-49cb-4fbd-9947-8615cf274083", "comment": "Malware payload", "value": "a06850be4f2af8f40f796666459898b5740982b5", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617366068, "uuid": "7e6ab28b-1240-4f1b-9516-ee5d80a3804c", "comment": "Malware payload", "value": "f587e6b0cb3f60b0f57b472e48c561dc7776f37acc43e59d9119643e249e6b5fca0603429b2db2761520829f3ac3267d", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617366068, "uuid": "ec1fbe2d-d1f6-484c-a37c-c9477051e3f1", "value": "6D0633ABFA514039D06720372CBA8740F71387F5719392A5EA463E3DE37D7098E5A236", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617366068, "uuid": "1b6a89a5-020c-46f6-bc72-c36a25b5afa5", "value": "98304:XWC+5BoTQ1prkyFveliPBcArl1ZWEXpaId3WJY0xfvlivDGCij:XWCtQ7rkyFvTBjPX+Y4v4Gv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617366068, "uuid": "dbca3244-972c-41cc-a6b9-d04c352a61d8", "value": 3770406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617366068, "uuid": "1db53d01-0fa8-43b2-adb4-b408e395b1e4", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617366068, "uuid": "40f866c9-fef9-4f91-b6a1-41ae8153f96f", "value": "\uc6d4\uac04KIMA2021_4\uc6d4\ud638\uad70\uc0ac\uc548\ubcf40331.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9449aa-93a1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617360758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360758, "uuid": "6499d090-d6f8-4cbe-9fd7-f20738a4b0fd", "comment": "Malware payload (AgentTesla)", "value": "dc1aa06fd4e4b275463c17b6483791d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360758, "uuid": "54345e4f-8c93-457e-89b0-d5a016445730", "comment": "Malware payload (AgentTesla)", "value": "7978ab9506437d357d1ee7bdc5cfe309235c3ebcae565a5e9733ec27236011ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360758, "uuid": "f9187916-269a-4b75-b500-3e486c2dcf42", "comment": "Malware payload (AgentTesla)", "value": "b459adce11325534cb224961e033274c61debaa4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360758, "uuid": "4bed3411-61bc-480d-a10c-46284ac34910", "comment": "Malware payload (AgentTesla)", "value": "4a9f94707a3df208026a88f8fe32e43eeafd8d885033d429b090cef63f74cbefc33036faf46dc6cd1801e43e7b085056", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360758, "uuid": "7f09e2e9-6317-4c4b-8f0a-3a159d054952", "value": "4BF4CF3073886BA6C83E67394824514053F2F556EB16CB5FBCD8215E2E63F4A8336B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360758, "uuid": "d88c2845-bb5e-4923-a29f-aaf338cdcbcb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360758, "uuid": "df115510-3124-4ff9-a523-6359ba547097", "value": "12288:PAra3BzzQiyGTrEigW9nBJPd60twLRez+KulCulN:PAWWiyGTrEhEnDP4kwNez+KuUulN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617360758, "uuid": "06e07b46-8269-49f7-bd3e-166b5e76f347", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617360758, "uuid": "8ef5ffa9-b540-47ef-930b-d6efdfbea234", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360758, "uuid": "42b5d437-7fb5-4135-aa1f-401c747e1e0f", "value": "PO3567890-=GHH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ef2d33-93e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617390839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617390839, "uuid": "43250fe4-afd6-47d9-bec2-425724afa505", "comment": "Malware payload (Dridex)", "value": "b5b9cba33aac9be7f7012784b28f5d5e", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617390839, "uuid": "0f430ee4-75b4-4f60-a69f-6efddbd82512", "comment": "Malware payload (Dridex)", "value": "797abffd4ef4832b9113962fbe4e90ce9bf44d04504784cecbe5d1413c5aaf6e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617390839, "uuid": "3ccb8631-f3eb-446d-b4e8-5c7f86997ffa", "comment": "Malware payload (Dridex)", "value": "899cf7cb2dc7d9d3c4c1d3a729066d0acecd8265", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617390839, "uuid": "5cec884a-4c0b-4efc-9a38-98563288b8f6", "comment": "Malware payload (Dridex)", "value": "47d42aff5443d97b7bcf9a9d9e46db1c5df8399da5ae9d200dffe29acf0d75af07b402cd6daa8930c9f86d4ae342dd37", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617390839, "uuid": "22bd005d-0884-49e4-9fbe-5a4626e9d79a", "value": "0A14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617390839, "uuid": "368dc9c6-728b-41e1-8ad6-ce56530a323c", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617390839, "uuid": "7de2689b-c971-4ee7-8260-bfeafff6a189", "value": "3072:Kopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:tpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617390839, "uuid": "0c70f83c-72f5-4fdd-8bb8-0db54cf814d9", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617390839, "uuid": "f3be8714-1a14-4c21-8b14-2431ddad515e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617390839, "uuid": "1a0127b4-7f6a-4f01-beb0-a18438bb82bb", "value": "797abffd4ef4832b9113962fbe4e90ce9bf44d04504784cecbe5d1413c5aaf6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e252ef78-939c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617358758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358758, "uuid": "05cfc099-d833-41cf-92bb-ba4c178f21df", "comment": "Malware payload (AgentTesla)", "value": "7b8ff6741ee4c4de454c5ae096cda9aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358758, "uuid": "8784b092-9441-4a6a-931f-0f645254bdfe", "comment": "Malware payload (AgentTesla)", "value": "7993ba633a394eb17622c0d64a1fe412e40b7991c0685737f2b0ab1ac5601c58", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358758, "uuid": "49032ac5-bc84-493d-b32d-e1c593a645ca", "comment": "Malware payload (AgentTesla)", "value": "4af7de4d4ee12fe06138e0491d907ea74d580cce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358758, "uuid": "6ab22669-9d67-43d1-97b8-83e7bed9ecc1", "comment": "Malware payload (AgentTesla)", "value": "406dbd8b03239ca86ffd84d9aeac0b851c3f810b35e4eb31bc703c5032d46510a408865fa6e72e1972d544b383727558", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358758, "uuid": "d2d20682-a7d9-4b80-9d1f-5496e8a1b125", "value": "F9A423CECECC6DF35A8D88927AD0D832269AF5855F3EAB19C5758E018263153CB067DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358758, "uuid": "6dd61d3b-3b3f-485a-8596-86f70183c55a", "value": "12288:w8j30XlRBrscZAgdQLDTQQnVnTfstKIg1K:w8jo746czVnTfsFAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617358758, "uuid": "a1cb32c2-d80e-40e2-8a63-967403b1907b", "value": 492958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617358758, "uuid": "9ff7e2dd-4e29-44a5-8064-8b0faffc2b68", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358758, "uuid": "ffc91bcd-0195-4e4a-94b0-d81c1460552a", "value": "proforma invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c639c7-93d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617384342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384342, "uuid": "60647ed9-b6ef-44a6-b9f6-c001489c7334", "comment": "Malware payload (IcedID)", "value": "d1fcc99021cd81f5416cc8dc5b5c2354", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384342, "uuid": "8ceffd9c-d3ff-4d49-879b-1a572d658548", "comment": "Malware payload (IcedID)", "value": "79f1a8f2d6ee1191a814af53a212a9bda8ce7c5aaccd27a38b3e04b36ce01bc0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384342, "uuid": "6164462f-302d-4960-8119-d715b7515244", "comment": "Malware payload (IcedID)", "value": "8714744411fb29217a2965351003cb6f471efd77", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384342, "uuid": "1829d754-0d46-4bba-92ce-96dc4a26d953", "comment": "Malware payload (IcedID)", "value": "6028b93b1c65a2de5fa80743e70f6fe57eabe2d11bfde35f90857ef94fed103a41350cc2d52ab9182465411218cb74b3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384342, "uuid": "55737b44-d8c7-4e53-be29-1da16359a4bd", "value": "4E530A8947503C91C0FEBD34F3A69A58931EFB30AA8F47B794C46BBAC47B5409723619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384342, "uuid": "06a1be00-3150-46e4-9f11-176715ea85e9", "value": "eb10ff98c4adb7472a591c82bd2ff673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384342, "uuid": "9c00cbf5-6922-458b-8795-fd7e45321656", "value": "1536:caCAzXz8T6rLXah8lI+Idu+B3XbuF6dRiF:n/gTkXayetu+BbuUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617384342, "uuid": "62cca719-0e10-4e5c-8cc2-0b0d8b62a4f7", "value": 65568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617384342, "uuid": "c4686c5e-d33e-47da-8e3c-2ef03d76d683", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384342, "uuid": "e8cb4e23-cda2-48b2-8c52-f044ea4f0ebb", "value": "79f1a8f2d6ee1191a814af53a212a9bda8ce7c5aaccd2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e80273-93a1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617360593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360593, "uuid": "da9e016f-d48e-4fab-904f-c64bb9aff7e6", "comment": "Malware payload (AgentTesla)", "value": "30af62783d9740124b4d51cc4fda6a9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360593, "uuid": "8dc856aa-498a-4e04-bbb4-76c6f3d947b3", "comment": "Malware payload (AgentTesla)", "value": "7a8b7278b421fc2a60909aecd33ee85778d179933223a854d1d094441919227a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360593, "uuid": "5e623c56-093e-409b-ad00-200069e4d304", "comment": "Malware payload (AgentTesla)", "value": "2e5ffd1dbadb15fa0c222960f359b9e87a978ad6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360593, "uuid": "5c7ec4d4-5f28-490a-8f1b-b73bf48daa92", "comment": "Malware payload (AgentTesla)", "value": "71d2f8d068ccea427e49cee2a2964a1464609fcbf38d3fc1e637a62e55ee8c9e66dcbc2af7b9454eb4c6bbcf6e2f43c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360593, "uuid": "d6f81ad7-54c4-47ec-b794-c0b953eea15a", "value": "51257EC9724071DFC857CDB28D681C6096617D7E431BD20B60633A9EBABE683CE159E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360593, "uuid": "ff60d178-7281-4843-93a8-e98d845d15ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360593, "uuid": "770b8041-d6bd-4fdb-8032-b5261956b8af", "value": "24576:XgOQwUqbmNc0DUm40nJf74RwHQboZCZqD:FngUt0nJf74R9boZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617360593, "uuid": "786fc87e-d464-4316-b529-d8bb28c45f56", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617360593, "uuid": "fdbfcd41-5a43-45cb-998b-344152593783", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360593, "uuid": "ffc5cb53-150c-4b3c-9d9e-086f5b2f067b", "value": "09600000000000000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c19f8d9-93df-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617387282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387282, "uuid": "0a844254-a4dc-4563-9805-591482025770", "comment": "Malware payload (RedLineStealer)", "value": "6488c5b8360a5af1c1d0881b5659c566", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387282, "uuid": "af178a8b-9a2c-47a2-8c9f-ffc0b646692b", "comment": "Malware payload (RedLineStealer)", "value": "7b31e9a3eb1d1b86583a4ce6df3e7acc24fac0c6ad9bf484b0158a508476c7b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387282, "uuid": "357f355f-ca9d-4e30-bdb1-e84df73386f0", "comment": "Malware payload (RedLineStealer)", "value": "c8920d9149d4467b4967230e66e7cdf4edd132d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387282, "uuid": "31ebdc72-8447-477f-a1fb-3d263d1296ad", "comment": "Malware payload (RedLineStealer)", "value": "67e91a9de8a00a429ab2645d09509ba1094872cc7729bb7a5a49db63eabe1f486f600e7e79af0e91cac5a0513bfb327a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387282, "uuid": "e0acd025-a2f1-43cd-8197-7da4c3641730", "value": "0094CF11B7D0C032D1A36476892AC7B15EBF78712A355ACFBBC55FBA1F202D09B26316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387282, "uuid": "e2860c58-909f-4bb4-aebf-94306231f927", "value": "2e24e904811fb698170d02c0338dab33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387282, "uuid": "2798bb9d-59b2-4a1f-8998-51b42e31226f", "value": "6144:6pfmPCmy7iW9tKGQGAR0GJ9V0w1sf3/a3zNVNzyjjMXUN:6puy7iW9tKGH+HJ9V0wKvAtGMkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617387282, "uuid": "9d78cd48-bac3-4e7b-a877-222bf8869ce5", "value": 433152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617387282, "uuid": "efc1f93d-fdbc-4d56-82c9-001843ee6441", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387282, "uuid": "c8d23090-b108-459c-a78e-b3160a8c4632", "value": "6488c5b8360a5af1c1d0881b5659c566.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "568f6701-939e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617359383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617359383, "uuid": "b0423303-3278-4852-becb-c1535302dc38", "comment": "Malware payload (Dridex)", "value": "454f5d5e8905ef28a14fd32db1686c39", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617359383, "uuid": "deeae5f9-ed7d-4d54-a943-b52f3dc36eaf", "comment": "Malware payload (Dridex)", "value": "7b514c10546f85a87c5c9afb8fd844023ac0fee4aa29a18c17d2233574c4182f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617359383, "uuid": "72838b02-cc42-426a-accf-50bd2d5e0656", "comment": "Malware payload (Dridex)", "value": "9594681ba20c46c17ab35e9caa2bcd835b3e05a6", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617359383, "uuid": "5948569c-36bd-4a90-b7fe-e2324cab2026", "comment": "Malware payload (Dridex)", "value": "4dede97b81f48e35e53a276ba8d0e3c953a6e319e1ae654eeb77f925105907ee265e0b1441b47572a7d5f096efba6f26", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617359383, "uuid": "b1017c99-1ef5-421d-8455-6a704fcf3be7", "value": "4014BE4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617359383, "uuid": "f215ae0b-2329-4cf8-b96a-d394ef691738", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617359383, "uuid": "7a276d99-22fa-4979-b073-ced5a1816fff", "value": "3072:9opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:ypjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617359383, "uuid": "0304142c-4e8f-439d-b972-076532286c92", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617359383, "uuid": "7541f364-bb24-422f-9136-97ce6943fcf4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617359383, "uuid": "a9ab9789-b0f8-4bea-8c72-1f0f86a8d15b", "value": "7b514c10546f85a87c5c9afb8fd844023ac0fee4aa29a18c17d2233574c4182f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb380cec-9365-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617335097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617335097, "uuid": "e59164d1-5370-4916-9d74-d5410f6d4062", "comment": "Malware payload", "value": "72fd9034644844914fe20cb9e8d3a99a", "object_relation": "md5", "Tag": [ { "name": "mariotessarollo.com", "colour": "#65BC8D", "exportable": true, "hide_tag": false }, { "name": "www.sogecoenergy.com", "colour": "#460AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617335097, "uuid": "f1e9b5df-11b0-41de-92d3-09034306a4ff", "comment": "Malware payload", "value": "7c74c08c57b18ea03153b277343559feee78712dc0d924a0db0b13097810785a", "object_relation": "sha256", "Tag": [ { "name": "mariotessarollo.com", "colour": "#65BC8D", "exportable": true, "hide_tag": false }, { "name": "www.sogecoenergy.com", "colour": "#460AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617335097, "uuid": "f9fbdac4-be9c-45eb-bf33-2c7a943c89d2", "comment": "Malware payload", "value": "a05748db15d5b990006406a19aa25cfa44028230", "object_relation": "sha1", "Tag": [ { "name": "mariotessarollo.com", "colour": "#65BC8D", "exportable": true, "hide_tag": false }, { "name": "www.sogecoenergy.com", "colour": "#460AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617335097, "uuid": "ad1ca0f5-6eee-44de-81ee-0c289d35519b", "comment": "Malware payload", "value": "8d1201a1ca638e9a682f4f2498ce83529f5aebbb58a80971c2c917182dd49c5f8f5ac78b352ecad39af60d4b4616982b", "object_relation": "sha3-384", "Tag": [ { "name": "mariotessarollo.com", "colour": "#65BC8D", "exportable": true, "hide_tag": false }, { "name": "www.sogecoenergy.com", "colour": "#460AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617335097, "uuid": "84baa9be-78a3-469a-bdaf-da8b476e6a27", "value": "3724226D91CB5F8AD63B783E90F9D9305485F2F7E607C1B414163F60806ABE4B284A7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617335097, "uuid": "3339a2e3-3899-44dc-bf02-5d652d72105d", "value": "6144:nKvPI/Y/1owQCcz6nAD+nLXxQTMJMBAVhV:n8g/YqC2CyhAVhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617335097, "uuid": "de4db1bb-aa1c-4b80-9c7e-7efee13ada06", "value": 221760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617335097, "uuid": "ff39188d-a726-482c-aee4-fb1e3ee57f04", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617335097, "uuid": "10aca107-701d-486d-91ac-063d3f7dcee1", "value": "ag.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f18ff100-93b1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617367803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367803, "uuid": "6e9a4655-f99f-4617-a47f-76e171d1e75d", "comment": "Malware payload", "value": "a05d2ee82a6fb1a015cc406045e7ca78", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367803, "uuid": "5bddd8f0-54d3-43f7-a5c5-56143fdb8a03", "comment": "Malware payload", "value": "7c8a855cef482a9551706005f7147c95b7319b338412905021ee71b13611a2b5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367803, "uuid": "4a01c042-20bc-45e8-bbc9-154230c2eb5e", "comment": "Malware payload", "value": "87326508006b7fe7c9ab826122477d5114b9a4e8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367803, "uuid": "ac9ba9ae-6b17-4b74-9cb4-5235f2822bac", "comment": "Malware payload", "value": "51b6663de1611041554d0d95c010251f8cb6bed7bbd0c8f7dd78c6a2accc99e82b916fda234b9d2a53e296011b8240ca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367803, "uuid": "f4d7a40b-f6a4-46a5-819a-ce81b04fdf2b", "value": "06236BA088F520C0F13687B72DF92A66F934381DF75A9E8F5048BE0572666F53236B5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367803, "uuid": "2b6085a9-8092-4f59-af6e-1ad21cdaf908", "value": "899ed385f326a8d1a9ab31e32ad45491", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367803, "uuid": "5719ba19-cd9e-4f19-ab7c-236f723f1516", "value": "768:7kClx2sQfcyCylq5HaoRsnKvtGW/wt05E6HZaPIz28+QC7SK0ZqxOWVXP:7Dx2pfcyUrCYcvW/HZ80AQuBnrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617367803, "uuid": "93e6a5f4-9679-4baf-9f22-b0f41b739ba0", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617367803, "uuid": "04f3a875-0b86-414b-b96b-39c761fcbbda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367803, "uuid": "eedde15e-e8c6-4d78-b689-a6d67fd74c72", "value": "ceuduwcw4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201a76b4-93de-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617386779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386779, "uuid": "32f16bd7-ab6f-4c3e-bf9c-adc980acc433", "comment": "Malware payload (AgentTesla)", "value": "2060a0088383cad1a87e071b59d2095a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386779, "uuid": "947ae63c-06cf-41e6-88d8-ca39a9ebd227", "comment": "Malware payload (AgentTesla)", "value": "7ca08e3c5675794df9795886094d83a5492937e8486c4d0173bf15d4a60af843", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386779, "uuid": "3f5658ca-0a32-489e-988c-632361639c5f", "comment": "Malware payload (AgentTesla)", "value": "144b5ccb697d54b2477b40b5bfff82371e14f469", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386779, "uuid": "0f4cfe36-b5d3-4d90-a102-926f136de726", "comment": "Malware payload (AgentTesla)", "value": "404e0150b00f8346497c02ad2063f48044d988d3de5ad7ef40c6a38aa9efcd4553c48f081ed75f7aac0c66463a27b7f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386779, "uuid": "7f7f5cc3-d864-423a-abf7-22260ca6308b", "value": "4CB4CF3035986B14F17ADFFE28601110CFF5A67DD216E64D9E9022FD1872FA096A9E33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386779, "uuid": "4ebab896-fac0-4f6d-94d6-f28f01cf97a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386779, "uuid": "0b05f508-2571-4bf9-838a-daf703406aba", "value": "12288:jvX20UFqbIBmVvyhKnnW3aRfktrkEabSew:DUIcBmVah6zJkSE2Sew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386779, "uuid": "262eb8ea-7255-4c79-ba75-5437228d04c5", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386779, "uuid": "9ef91da3-8ff7-4307-a5ec-93802957f68a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386779, "uuid": "f1099316-34cd-4be2-be07-cbd5e85fb90c", "value": "\u7f8e\u91d1\u532f\u738728.84 (USD 40,257+5% \u7a05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8785d6b1-93a7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617363330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617363330, "uuid": "37433d63-54d2-4eb0-9653-2d399d3e10c2", "comment": "Malware payload", "value": "92d36b9a035019e3e61c1fac429d8d22", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617363330, "uuid": "2f3c1fdc-2f46-490c-87c1-c45596d6f008", "comment": "Malware payload", "value": "7cc19d5fe4db5d799b3d1569304b5e13263487c8ce389a545596f46a30489933", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617363330, "uuid": "109d2581-b9d2-4081-9219-222d83edcda4", "comment": "Malware payload", "value": "39e9420fd1d50467321afc22430c75d216936756", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617363330, "uuid": "27178911-ac45-4b45-be02-7e7341e13407", "comment": "Malware payload", "value": "7ea715bfd6c7d8112386fec2578230c927d758b5aabfc10d970d8db39c45465c566c78215f06482271441b339eee8c48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617363330, "uuid": "4b56e2cd-3697-4b9e-a9f4-77c42275302f", "value": "CAB4239D42002E83D9697FFC6B60AD3737A78EAF328B7A134C15B49D9BB50182E4CD50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617363330, "uuid": "0fc542db-61d5-4227-8831-42c5df1cf70e", "value": "12288:nx+OXwHaGUlKCYe1doL6mE0tCO8MzTW10jbocKSEy/0pK9D:nxVwHaGUoCYFunxO8pe/KW0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617363330, "uuid": "31d5837f-a100-4f69-9fe3-6fd17884e8c6", "value": 529207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617363330, "uuid": "90c82afb-6a84-4981-9f59-16c298c5ec2a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617363330, "uuid": "c275d623-6bfd-4936-87e5-6e04a4f494de", "value": "Updated SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd9ee085-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617386614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386614, "uuid": "5b6292d6-f9d3-42c2-a4bc-fef55fa13134", "comment": "Malware payload (Loki)", "value": "b5c7b5c0d4131377e11527e523c040db", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386614, "uuid": "d03cf9dc-d2f1-47de-be80-769a904244c9", "comment": "Malware payload (Loki)", "value": "7d0b6227d0e62575a3b8df389f3b1f5fe0bdd88aea7e71cec479dba61777cca0", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386614, "uuid": "a7727f44-d98c-4315-b60c-121e17a7b909", "comment": "Malware payload (Loki)", "value": "088fa58ce72564123fabb6a3f2d101d66e956039", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386614, "uuid": "279bec90-aa40-4033-8b04-5b7d1e693bf9", "comment": "Malware payload (Loki)", "value": "48b1268a3a1037ec0752393843045c58fa1a5b32eb5b189204997b9e0f06b38d2b8c3f535bc1389e8078577e5df8c3ec", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386614, "uuid": "a4d24a5a-bbbf-4e7d-9ee4-26b28098cb94", "value": "19F38CCC752072DFC857D872DE982CA4EA65747B871B8213902716EDAE0D897DF190F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386614, "uuid": "aa978274-1f1a-48c1-9aa8-2ec0f69496d9", "value": "3072:oanxUNdyj0M1OimkyIZw7gmcrnFe+8i6sGKc0RSehGowL13zYR9m:ii/n/msnDbPc0RSkGow13zYR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386614, "uuid": "c925b618-446c-47d6-b434-75d01fa69320", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386614, "uuid": "00fb47af-94b7-43c3-9bfc-fed8ab2bb0fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386614, "uuid": "d72d98e7-690c-4aed-90b4-5567ebdd6745", "value": "Purchase Order 0417.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0517674c-934e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617324886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617324886, "uuid": "0c472242-3c8c-4cac-a31a-e0fe5ae8a04a", "comment": "Malware payload (Dridex)", "value": "6f3f1966f2fb07637012ff3fffc1b043", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617324886, "uuid": "b350d742-b62f-420e-9a04-241fd4b27f11", "comment": "Malware payload (Dridex)", "value": "7ebc5f1068effce3081d4c5b92493b03e30997f45300392af50994290a958d35", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617324886, "uuid": "6408bd82-9f7c-4435-893a-bd802c1dc554", "comment": "Malware payload (Dridex)", "value": "847cd35cca70c7edbb5f433da1f53ea38e5c9a67", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617324886, "uuid": "20f91a9d-eb9c-449f-bf54-fee9fb771a87", "comment": "Malware payload (Dridex)", "value": "a88ef20263d2bbc73f9c36e14d44ba74473ec06a6263fa9b2dd62794e938c96cec9245e8de2f84b09b01384227086807", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617324886, "uuid": "b3c569a6-e434-453e-8c54-66ef64ff6079", "value": "9914AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617324886, "uuid": "5b73e99e-45b6-4af6-9f23-b3ca2e409005", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617324886, "uuid": "6b9dc9e3-4880-45f6-b07b-272e7ca939c2", "value": "3072:41i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ki78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617324886, "uuid": "d19db592-7d41-44de-9f98-9b718ba14baf", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617324886, "uuid": "4e5284bb-2a80-4ca9-92b1-4e827fc22a1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617324886, "uuid": "cdc33893-9a4a-4849-9455-2c7a7b2be699", "value": "7ebc5f1068effce3081d4c5b92493b03e30997f45300392af50994290a958d35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51c1920-93b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617367755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367755, "uuid": "d288c9d0-0b42-442f-8b54-90b96d86fdd5", "comment": "Malware payload (IcedID)", "value": "1273fa4d6935760f15e42a61045b7a6c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367755, "uuid": "2c73fbff-9b58-4786-9dc3-0dbf1dd9fd43", "comment": "Malware payload (IcedID)", "value": "80ff2a21f0798873593b0f06f0860221019933f12fe4c623fabb5fe1062b4789", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367755, "uuid": "e3f314ce-b228-487d-b30f-b630180c09e4", "comment": "Malware payload (IcedID)", "value": "3017f1ecce5378e7b30ee14f244337c34ca37d48", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367755, "uuid": "5cca96bb-cebd-426e-9784-4cff67077616", "comment": "Malware payload (IcedID)", "value": "cf72ae2b5c91aef3519f02af5b250ab548cc12cced35c206f70043488d81c7430bc58afe814fdd12fce6e24e43a0d193", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367755, "uuid": "6a5bc108-f5ef-4abf-b995-317c7714a91b", "value": "8214F7935CCFB663D42F90F1A8A1547D7F30BCC413E297DBA9084B1AD993792A972318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367755, "uuid": "57d68b02-e1fc-478e-9430-e7a46023307f", "value": "3eb5471c5370e4bcb3be6637e4995a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367755, "uuid": "cfd0570f-1fef-4b27-a98e-42f3768cc70a", "value": "1536:Vq8ByBeZnwLGM+NoV1XjeNSaziIz7Ja5j/Nj/IXoZcq+M6qaCZZtr2wS+FJZLT:Q8+Kjv4RECZnrDSGZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617367755, "uuid": "23a824bb-8db0-42e1-af47-a368631cf7d1", "value": 203808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617367755, "uuid": "5c8c5a19-89d9-427f-8d54-9312cabc2d15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367755, "uuid": "a99f25c4-01bc-4540-b608-bc87bd7db23f", "value": "Hodas_1.vyur", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1bac6b4-93d0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617381037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381037, "uuid": "69816ed2-1b33-4771-b8b6-77b22ebd4fc2", "comment": "Malware payload (Dridex)", "value": "aacba6f145d2fe53ca575786b6dc3340", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381037, "uuid": "c746e4e8-f747-4191-9c61-b35370fe47ac", "comment": "Malware payload (Dridex)", "value": "83284b5a05f7969101899759726c10c69da51723fb9410ecc409401ecb4317ca", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381037, "uuid": "90493165-6989-4e44-898d-a3b040b942c3", "comment": "Malware payload (Dridex)", "value": "5bd689cf516fb96919dc1a079b4b94f8b8cff094", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381037, "uuid": "484967d6-a88c-4c4b-abe9-1c1ffc833315", "comment": "Malware payload (Dridex)", "value": "ea55d4494eab4ebb5ec102d201048a630c4fc2c39524aed7160694f6f0c51bac869b9f5ddb465801e26e0c17e93d169a", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381037, "uuid": "8d87a7c8-a240-4ec1-ba5f-e5fbc1dd870b", "value": "A414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381037, "uuid": "585a31bd-94fa-461f-9f97-9da2348465db", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381037, "uuid": "93d385bc-6b93-45e4-8194-c2755ce59dca", "value": "3072:Copj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:VpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617381037, "uuid": "515fd29f-b1be-43bd-887f-8a3543b6497f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617381037, "uuid": "8144aac7-cb10-4f66-92ac-9dd7e13211ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381037, "uuid": "b20730af-9981-4574-83df-5706a1bd9409", "value": "83284b5a05f7969101899759726c10c69da51723fb9410ecc409401ecb4317ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "205892de-93ad-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617365734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617365734, "uuid": "5aab6ad3-f573-44a1-aed6-35b11d1c501c", "comment": "Malware payload", "value": "84633d19d62ea1e82ffc5dfa5d053f8a", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617365734, "uuid": "2db95518-b269-4782-ad1e-b48b97d769ec", "comment": "Malware payload", "value": "8364f2fb26970b60f80ed43243af879ede178d2af2acd9cef3db3dc6e2b5aa12", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617365734, "uuid": "5803aa1d-2285-4b38-a933-f4dd4af871de", "comment": "Malware payload", "value": "ddad285a5ece7cfe6602ee8f96c8d86f63c86f0a", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617365734, "uuid": "18496519-2667-4202-9e04-0f2bd6440209", "comment": "Malware payload", "value": "34e8a530d64f62cc3aee3dc57c4fd267e6fc83d209d0956fb6cb2ee7b1170f3ebc985f887f1ecb8eb81662fbaaa5f89c", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617365734, "uuid": "01069eb5-a3ed-4753-940a-ef5632099c33", "value": "DBE068C4E4B89F33EF114775A9727823723648D203E7440B99812E847068CD3265F792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617365734, "uuid": "e811fa7a-20af-4d86-9d68-948a73afee62", "value": "6:TMVBd6OjzmC3mUifmReUdzXxjmUifqgbReZgALcpADSTIz+0UYC5EJ:TMHdtWa6fmEUdzXV6flbEZh4axzZU2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617365734, "uuid": "89cf0a0f-0733-4f7a-a731-75ca8a8f69a4", "value": 366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617365734, "uuid": "7b44296b-ff62-474d-92fd-7da720ba223d", "value": "text/xml", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617365734, "uuid": "4c826fd5-7979-4959-a97a-6d91414e2bca", "value": "8364f2fb26970b60f80ed43243af879ede178d2af2acd9cef3db3dc6e2b5aa12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2e2767-9395-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617355396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617355396, "uuid": "6e617309-6c17-4a39-98b2-aa9d140f3658", "comment": "Malware payload (IcedID)", "value": "00cd62df65b1c4455ce3f94bc9365f94", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617355396, "uuid": "45798fe9-3515-42b6-882f-e7fda53ee8d5", "comment": "Malware payload (IcedID)", "value": "83d80467c78e410aed296bd36186c6259040197c6956de58ad31f10652d1b844", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617355396, "uuid": "33cb5528-5074-4bb4-ad8c-8ecdd403b286", "comment": "Malware payload (IcedID)", "value": "3c1fe084b2e739a370465df891ecddb5587275b9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617355396, "uuid": "014b5af7-b8d9-4414-8304-80568898621c", "comment": "Malware payload (IcedID)", "value": "5d3661bbd58aa0373dda2a95594d6db052b9d7146b0f630e08bc2ceb03e6d84f1233cdb012de105a9714fa7666f721d0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617355396, "uuid": "966b5227-7004-4774-881d-414b60201521", "value": "2514F7935CCFB663D42F90F1A8A1547D7F30BCC413E297DBA9084B1AD993792A972318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617355396, "uuid": "b14a7808-3c83-4834-a721-f6b99129ee64", "value": "3eb5471c5370e4bcb3be6637e4995a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617355396, "uuid": "68556940-678a-499d-8a38-7b45e7efff2b", "value": "1536:Vq8ByBeZnwLGM+NoV1XjeNSaziIz7Ja5j/Nj/IXoZcq+M6qaCZZtr2wS+FJZLTd:Q8+Kjv4RECZnrDSGZnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617355396, "uuid": "97682d52-d0c1-4897-93b0-9389b4be9ba4", "value": 203808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617355396, "uuid": "adfae320-e4b4-43f1-ab4d-5c2769f1868b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617355396, "uuid": "3481267c-4031-4932-ba6b-755cb6fc49bf", "value": "83d80467c78e410aed296bd36186c6259040197c6956d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f00f94-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617386554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386554, "uuid": "ae379887-8456-4adb-9dce-b81b6c07bfd2", "comment": "Malware payload (RedLineStealer)", "value": "c86f9a7f943635607457e1b1ca90ce7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386554, "uuid": "291edc09-9f7f-4a07-9b91-b967cffaef60", "comment": "Malware payload (RedLineStealer)", "value": "83f9b6d6a511c4cae8cb49a92fd18a6333067c50bc1ace0c00324c4af27887e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386554, "uuid": "a89f9d01-542a-4df8-a666-8fbbb30010ad", "comment": "Malware payload (RedLineStealer)", "value": "66c91aa0292e19e58c84fe0c99427eaedada1066", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386554, "uuid": "5b3bc409-74ea-4f8f-bb54-d172e8e5327d", "comment": "Malware payload (RedLineStealer)", "value": "95c9e36435bd31bc3acf870f8c6a97fe5f355fb8c992a5923273b644d8dd9e5d20cf75de8698ca585515feb033c887b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386554, "uuid": "f52941be-43d2-4455-9849-e8e2573194e4", "value": "2F64E001B0D4C873EA565A790925C2A58936FCB25F3556CB3B943FBD5F322D18A3A383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386554, "uuid": "9fd7c63b-5ca4-4921-a755-bbb33da3817f", "value": "d2d03b007a12b2c8300987fcf9d1912a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386554, "uuid": "f7a31aaf-5c07-4b53-9855-4e198fcf8f22", "value": "6144:P8h4AdWu2oKcjv9LdvO0EnTXHCEKMrV1n6Yv7G:a4bjIdvO0ETiEdrV1n6Yv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386554, "uuid": "bf9bea99-e2fb-4ade-98c2-95215a649955", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386554, "uuid": "55f1050f-c81f-439f-bbe6-428e02275616", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386554, "uuid": "189d15bb-2c9b-4f78-b223-5607782a217f", "value": "c86f9a7f943635607457e1b1ca90ce7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4654a50-937e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1617345769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345769, "uuid": "5716fca6-921f-4604-abcc-dec23b621fdb", "comment": "Malware payload (AsyncRAT)", "value": "434c79e23b64f7d66d21a57833b734b8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345769, "uuid": "80b10ecc-a044-4ddf-9020-cdddf79062a0", "comment": "Malware payload (AsyncRAT)", "value": "843342ad2c4e11737f39f764fd421e3132d81195f7edf107c503b7d478f96d53", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345769, "uuid": "7e28b7a5-bd7f-4a6c-adb2-3af3127a121b", "comment": "Malware payload (AsyncRAT)", "value": "1929b138770efc696604588b9531fca4129b3186", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345769, "uuid": "a47df484-2c69-4cd0-86a6-96116e9db753", "comment": "Malware payload (AsyncRAT)", "value": "23040b06bb9e819695eb5b582194a588ccb86657b93a2edca7a256db58ceba873b4b39d8b5e3bcf61581be6c3afbc57b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345769, "uuid": "46288f37-a83f-4b84-9dc6-0f74e2270c57", "value": "A30412A273F0D48FD05642B122D3D936F6F9AA841664950B677C1F2F6DB1283C90A2CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345769, "uuid": "8f952d58-8b8c-4957-a1df-03c6ba3db622", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345769, "uuid": "ddf5cae8-dd6b-495a-abb8-3ac1f4f2617c", "value": "3072:vTs3BxJNmJtupdA4YouKjcbrFnular1QeOGzjwA4+uig+6c:vAPTIHKOrFnYa+Gzjy+uc6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617345769, "uuid": "358a82ce-d037-4236-910a-1f723ae65fc9", "value": 189187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617345769, "uuid": "df364a8b-172d-4f5c-ab02-93efa9c99945", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345769, "uuid": "5573df29-609a-44ea-a132-a09ea9654a93", "value": "Swift _Copy 3169777.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b56774-939b-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617357980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357980, "uuid": "bdbb2a4d-ae6c-4a1c-baf3-4c8485fbe8c5", "comment": "Malware payload (IcedID)", "value": "bb89c6f12bb7e6615bab48b1af6fa0f0", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357980, "uuid": "9fe40b44-57a0-430a-8cb1-d8c2d3d50591", "comment": "Malware payload (IcedID)", "value": "84558e229b112f64c102cb38404f83d6f865ef89df90ffd83d8bbb60e8427dde", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357980, "uuid": "9bb624f3-fcc5-4d02-9e36-b9bb4d17dd2c", "comment": "Malware payload (IcedID)", "value": "4aa28ceddfa9de92dfd72a351575fa46c6e1d942", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357980, "uuid": "02ae1814-c8e4-45f1-99a4-f6c0fa44f335", "comment": "Malware payload (IcedID)", "value": "600bd7d886b834220a6fbac2c6151ad25e4077cb217dd5a8b4be5e151b3eab8084c45feec21ba2785de515b421836b5b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357980, "uuid": "140fe871-2ee6-4927-98b2-7f400d9b17d4", "value": "53939DEDE907F4D2CA158F7C4D12758920BAC4A6265FF007709A622F5D22F6C095F2AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357980, "uuid": "7270a470-6450-4ba6-aae2-a05497a2535d", "value": "1536:uB2xe0FM42S2hawdIVseTSV7SaTe8NDUYl+LrHtlmuzx2ofDg:s2bMcMpnSaTDDFysE2obg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617357980, "uuid": "642e01c6-25fa-406b-90f0-04f55c8ea26e", "value": 94801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617357980, "uuid": "487d4026-4519-473a-80a5-f0f1425a9918", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357980, "uuid": "d08124d0-ffa5-42ca-8169-e217770cf449", "value": "documents-95598302.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "468701b5-93df-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617387273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387273, "uuid": "12048cd3-71c6-4eeb-8599-5fc3d290a0be", "comment": "Malware payload (NanoCore)", "value": "90081bd3e5ba030dc99d2c5ebde3c454", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387273, "uuid": "2faedec5-e519-4ffc-8dbc-a9518abebfdf", "comment": "Malware payload (NanoCore)", "value": "84b188dd8a56b5f1d076d7f8ec92f394055843db0f39990d67f8d9af5c41438b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387273, "uuid": "4387b0fa-0ed9-4924-814e-8845b5b6a766", "comment": "Malware payload (NanoCore)", "value": "9da348438de2c30172cdfcce1e6ddb202638bc7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387273, "uuid": "004f3bf6-e067-46fe-9e35-e1bcc8876ad6", "comment": "Malware payload (NanoCore)", "value": "459563cb9fb5414b486bcc25534a8943a4cd234d43dd0e798c2d3b4373b24c3321ca44455b5b6d0382416316849c227a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387273, "uuid": "95c15394-b735-4d37-9496-a3a88567717a", "value": "1135AE293F24518CC0A70B395468D00C9FE67DA9AAD3C2837FAE37EB6476F1347A4552", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387273, "uuid": "d83c040b-dddb-4e31-afa4-90a58da5efa7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387273, "uuid": "30b983cb-509d-4d27-935f-c7afca67f7d4", "value": "12288:M4xmmreQOvjUFxb1NHE7h+LGYi53FuPhzMUn9RrZ:M4xdeQIUTPk7/BpChAUD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617387273, "uuid": "9bc59f9a-5f53-4d81-ac58-c17a74d978e4", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617387273, "uuid": "0a95a9fd-5199-4d3b-83f1-9b7e475f05f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387273, "uuid": "56310bc0-434f-456d-a0eb-2c866afdad57", "value": "90081bd3e5ba030dc99d2c5ebde3c454.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb83a73-93ae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617366454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617366454, "uuid": "faf9fc6d-4ed8-4959-aca8-509908a7bf54", "comment": "Malware payload (Dridex)", "value": "1b4393f565b71b951a619be2f7f4066e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617366454, "uuid": "a9760745-b2c5-45da-9160-8e4de9c764b4", "comment": "Malware payload (Dridex)", "value": "873dc2b053bf81b50deca1ce349f686e1c60e02f3913d9261502687b8d562972", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617366454, "uuid": "4918f7e5-5ae4-40d0-9aae-717fde36390f", "comment": "Malware payload (Dridex)", "value": "581aaf83db318404d6abb3a332a29fedf54d0f4f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617366454, "uuid": "f0b7f04f-c12e-4ad8-a98b-0a55d7a876b4", "comment": "Malware payload (Dridex)", "value": "a33904fb95b75410103ec1cd8c37ad4e37214cf2a948cf123e95b8b92031045f22ec7f5aa703a8c384807c192795d77a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617366454, "uuid": "3558fab4-8dc0-4ec8-93d9-9cede86e4233", "value": "6914AE9DD729E464FAF3D9F104359A1210BB6C49892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617366454, "uuid": "bd027bdc-211d-46c5-907c-5bfa62e13cc7", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617366454, "uuid": "638fbf39-d16b-46fd-a7a4-84634ab13069", "value": "3072:D1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:xi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617366454, "uuid": "c194d948-9357-4c4b-9bc4-dcce0e3038b9", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617366454, "uuid": "2e4059a0-7d15-4bd3-8ce1-81804995a387", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617366454, "uuid": "4ab0dc0e-cc20-4c6e-8b9c-5067d34d74a5", "value": "873dc2b053bf81b50deca1ce349f686e1c60e02f3913d9261502687b8d562972", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d9f344-9397-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1617356325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356325, "uuid": "d7c1ba8a-4bcf-464d-af28-56a050b3b6e0", "comment": "Malware payload (AsyncRAT)", "value": "6490df82009c9b9b04a47bb1cf89a0c4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356325, "uuid": "f307993c-9118-4dd9-ba68-b45a9b4b8923", "comment": "Malware payload (AsyncRAT)", "value": "873e3cdc28e17be1027c5b88f5899d2859b40bdbde0c929d32bb26468931c6e3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356325, "uuid": "e567769a-b020-422c-b532-417bda5b2e3c", "comment": "Malware payload (AsyncRAT)", "value": "17dfbe73fa91d9bb0f22886c165df9ec85edd424", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356325, "uuid": "6dcc3db0-35ac-4b29-b711-cbd828889949", "comment": "Malware payload (AsyncRAT)", "value": "67143b095323731c840d66450c7acf36dad1ea9373be2bf6f7a17ecdbd3811d2855850265a32665076d7c93fc171db91", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356325, "uuid": "3770d561-d822-41b4-a122-a6f99c68f066", "value": "94F039524F5A673017C6AF400C9F10CBAFF15E7E03745BAD046368BB82144133931332", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356325, "uuid": "6837da67-ccf9-4b98-9ce0-0e9020035568", "value": "12:TTTTTTTTTTTzqaIDGuqRRMEaefgXZg/LTTTTTTTTj:TTTTTTTTTTTzqaufwRapWTTTTTTTTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617356325, "uuid": "d4169071-5577-44cf-855a-c8a035fadd1d", "value": 540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617356325, "uuid": "b8d0fe1f-e7cb-4413-8e4f-bbc139380b6d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356325, "uuid": "e7e242f5-b887-4cbf-9d80-29acc86c9479", "value": "TK29.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7785405-939b-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617358257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358257, "uuid": "445e75d5-32ab-4e29-8db3-b60325301f11", "comment": "Malware payload (IcedID)", "value": "f40cc4e9f516e8051c68476add34fb68", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358257, "uuid": "53b65888-367d-4926-b066-29108e92ad18", "comment": "Malware payload (IcedID)", "value": "883fc57b5494b71116dc0f7e3988a4a695adaa45281862269d3ac048703adf67", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358257, "uuid": "c8462057-e00c-4b9b-af00-42675303b102", "comment": "Malware payload (IcedID)", "value": "441ec742f8f3f20632697f9c3eaf11a49f13e1c9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358257, "uuid": "4efefee1-8da6-46f9-9b27-17a5396325c6", "comment": "Malware payload (IcedID)", "value": "4474ac262c433813c00510fce14005d5946d2d4d583419c274d8d1a83c034d00073e78a8f2d239c6e473de2848689c2f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358257, "uuid": "a3eca708-1bee-4dbe-a008-f52c764b3cf3", "value": "BE14F7935CCFB663D42F90F1A8A1547D7F30BCC413E297DBA9084B1AD993792A972318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358257, "uuid": "b951196b-f205-42bc-84f0-a11f1fb55ccf", "value": "3eb5471c5370e4bcb3be6637e4995a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358257, "uuid": "9592c6c8-f662-425d-82bf-5c3390273e76", "value": "1536:Vq8ByBeZnwLGM+NoV1XjeNSaziIz7Ja5j/Nj/IXoZcq+M6qaCZZtr2wS+FJZLT:Q8+Kjv4RECZnrDSGZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617358257, "uuid": "c6b942e4-99f6-43cc-9a44-4396e87c6b0b", "value": 203808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617358257, "uuid": "0ca326ee-17ae-4ce3-9fc4-7a601758a299", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358257, "uuid": "e98dabfd-dc03-4182-b90a-53ff00e9f901", "value": "883fc57b5494b71116dc0f7e3988a4a695adaa4528186.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a57744-93b4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617368770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368770, "uuid": "3eeed4d8-d9fd-489f-a54c-38bb43ed6f80", "comment": "Malware payload", "value": "8fe04f60f1d58582a740a4094c9cf5b2", "object_relation": "md5", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368770, "uuid": "4cbb5c99-52f6-4637-887a-6672f1add1b5", "comment": "Malware payload", "value": "89867740e614b4cb55236ea82a1e487b906766f8cd806aacf6c0ef1413141b12", "object_relation": "sha256", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368770, "uuid": "e0f7d346-cc9b-4e83-afed-8217e77d6b01", "comment": "Malware payload", "value": "74c10bf50951f492f5c97ffca962c01e03b51a8b", "object_relation": "sha1", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368770, "uuid": "660cc14a-d6b8-416f-9c06-f9ecf85873bf", "comment": "Malware payload", "value": "224f53d7467fb96c3ba00b2a1c4a4440536407950dd939a96c8cbc0d31dfbc2f8cbc9f781d684a7cbd8b629bc05cca44", "object_relation": "sha3-384", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368770, "uuid": "a2421829-ac8d-44ea-b6c6-fbe53bca030b", "value": "D1D533363224D433D237013049D5D7F2BEFBB934216A960EBBD80E3F7A955A4861A71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368770, "uuid": "6bb9c855-c068-48e4-99fb-e1ca8e190ae2", "value": "d32519c93924bb24d9874d86c5993ee3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368770, "uuid": "a1639c7b-127c-4f41-a3a7-7b307b54e780", "value": "49152:/PDpZqmjiEkVnkvb9sCagoChxZONMLfpctOBC+gMelRASgXSoS6:/zZKnkboChv3fWOk+UAMoS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617368770, "uuid": "d1b3bbdc-2af5-44a7-afe3-bb1d66344851", "value": 2984402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617368770, "uuid": "f7a105e7-6743-41f9-9328-d9ede43c01a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368770, "uuid": "5055ed23-9027-4dbf-892f-13f57a28632e", "value": "OneTap_V4_Crack.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7313cc78-93ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617394220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617394220, "uuid": "da3bb852-1185-4660-90c1-aa2dc0ec82aa", "comment": "Malware payload (njrat)", "value": "07de416d6093c63451a07477bc9f790a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617394220, "uuid": "482be8bc-b30d-463e-a9a2-85fd8908626a", "comment": "Malware payload (njrat)", "value": "8cb5ccee62cb939a88f8ee36da47518c7c11eef0378b4ce9e678502bd83dd5aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617394220, "uuid": "326dbc1b-e9ba-4e7d-99b7-fee69361b464", "comment": "Malware payload (njrat)", "value": "c62d0dccaa3a0434e35a1d7f299893c9118d16e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617394220, "uuid": "aa295fb1-c23a-4ce7-b962-ca3229fcb89b", "comment": "Malware payload (njrat)", "value": "bca2f12e5b2658152f2101494e1cde88133e3a24eab34dd2850fb9196925c3480492ea1ac3148621e6e3cf08a8e6d9a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617394220, "uuid": "9ee27c1f-dfdd-442a-be56-9af30e59a14e", "value": "CDA45C142BFC9A3ACE6E83FFA091041083F8B565E643E30E5AD4B2B11DB7761F892557", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617394220, "uuid": "49ec6404-33d8-4583-a0f8-dc8b0279d638", "value": "6144:c9b+3eMQM/aMOZabe3h1PtRjAqmYVNf3yTXcYBbt6KMBhuW/psvCC1amK:13F/aMDb8BtRjA7XcYNclBtm4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617394220, "uuid": "22fd860a-d796-4ee4-a284-8ae5e2248f22", "value": 470016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617394220, "uuid": "4a7ebb2d-cbfd-4eb6-8713-08f3ebcd5819", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617394220, "uuid": "575bbc8a-058e-4c13-85ab-bcde27c5a78f", "value": "07de416d6093c63451a07477bc9f790a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1cf4af5-9368-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617336450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617336450, "uuid": "7afe50bd-a109-4589-b80f-8f036d74c5ac", "comment": "Malware payload (Dridex)", "value": "6bf62d9ff4654b77ce6a5178c249a9ee", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617336450, "uuid": "23ee7822-0d12-421c-80fe-7789e12deb74", "comment": "Malware payload (Dridex)", "value": "901ae73abe1e59dd67eb0a14ccd4c33d4150a5609dd84552f8ffda647b844c17", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617336450, "uuid": "0e0587e2-1182-413d-b59a-115640020600", "comment": "Malware payload (Dridex)", "value": "400b16bfd66c43311851681f2147d21e8eb5dabf", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617336450, "uuid": "a5536a46-eeef-45c0-a0d3-69537d88cbaa", "comment": "Malware payload (Dridex)", "value": "28d78a5ff443d9586ec1fdaef3e36f4d06c1b85a09a0e273fa617f86a7835c705fbd47c6be7cede3e0b30a32f14773e8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617336450, "uuid": "b11e9e51-15b3-403e-928b-6fdf04733482", "value": "1614AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617336450, "uuid": "cb642aac-9bd9-4854-82c9-f28b95fba61d", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617336450, "uuid": "bdd7f361-a536-485f-8a29-c807c83860e2", "value": "3072:91i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Pi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617336450, "uuid": "1e7a6da0-2201-4e1c-8227-cc52c05300b2", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617336450, "uuid": "732ade73-a7a6-4f5c-b67c-460213e79938", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617336450, "uuid": "4bed5367-997d-4f06-9967-7f2b7b9f126b", "value": "901ae73abe1e59dd67eb0a14ccd4c33d4150a5609dd84552f8ffda647b844c17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3c2f4d-9392-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617354106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354106, "uuid": "0421c319-34d8-4acd-aed5-f746a4037685", "comment": "Malware payload (Dridex)", "value": "a2f3ce248d7f2afad21ac6a07d73a91d", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354106, "uuid": "3edd991f-f288-4620-b7d5-4988c776b857", "comment": "Malware payload (Dridex)", "value": "90dc0fab2bcd3997c2b33d09dad96b65c9aa0b95d5ef1713f7014586ea748e99", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354106, "uuid": "730d0a6d-62c6-41f6-8418-5e401f3f72ed", "comment": "Malware payload (Dridex)", "value": "84fe1b28d47ce5375ba9613987bb9e40aecb66d3", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354106, "uuid": "7f386c83-3b0d-44f2-b419-c7b6bd8fb92a", "comment": "Malware payload (Dridex)", "value": "2cc0ae4b04dab2fb701b054d63ca702cb7dd20460ffcf742f9f0caee1dabba626fc940056158453f96fbf71ff5d6c96a", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354106, "uuid": "6ed46854-4906-4576-90d3-3c1789148378", "value": "7A14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354106, "uuid": "27f6e1f0-4472-4be6-8614-42815e8ae2e9", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354106, "uuid": "ba6a4fac-c269-4843-978a-d0428058137e", "value": "3072:Vopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:6pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617354106, "uuid": "866b6f9b-cb9b-4f85-a074-10351fc75cb4", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617354106, "uuid": "d2fa0f79-f512-482d-b48a-d2ebb9b53dd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354106, "uuid": "c8144beb-57c8-43c4-b4cd-6b1d651282a4", "value": "90dc0fab2bcd3997c2b33d09dad96b65c9aa0b95d5ef1713f7014586ea748e99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1cab07d-939d-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617359160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617359160, "uuid": "2c8df9af-1884-4bdf-9dc7-cabd82a71a12", "comment": "Malware payload (IcedID)", "value": "a5e8609cfc6db4f7b184c920dbd795ca", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617359160, "uuid": "16ab9000-3638-4d7b-9045-b97efe6417fd", "comment": "Malware payload (IcedID)", "value": "90fb4b214f04269ec134cde90077cddbe54e79f66aa74c9ada5d7cce4e59ae88", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617359160, "uuid": "0e35d39c-dfc0-42e1-827a-7392e6c903d1", "comment": "Malware payload (IcedID)", "value": "c03a721606fe7f1b54b9fa994528a9b7cb1bbd43", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617359160, "uuid": "407184bd-7d66-4ac7-9f83-d3b7b903cd01", "comment": "Malware payload (IcedID)", "value": "432807aeb491e52a2b139fbe79495c0f785df72c5110e575baed79560f38a49354b781431acffe2eb411253b92688737", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617359160, "uuid": "15f2f65d-c484-478a-b8a9-018fe9fa0e87", "value": "F2C3298D6B907CA1C0FDBD34E3A19698821EFF309A4F47B794C5AB79C0AB5409623749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617359160, "uuid": "5dd8b484-0606-4cbb-89df-863ea49764b9", "value": "eb10ff98c4adb7472a591c82bd2ff673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617359160, "uuid": "8e0c98e4-2d0f-4214-a50e-985b75062c36", "value": "1536:fmXIFRBSvf0EW6SL504jXnk1Nzva2Xj3108/l:dbafVsL504jXk1RvlXJdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617359160, "uuid": "0760f673-0946-42d4-b41d-4254fdbffc2e", "value": 121471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617359160, "uuid": "c6c9b206-6cac-42a5-acab-d4a3ab5799cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617359160, "uuid": "18ec1d00-4d58-46ec-b0c4-588295b02211", "value": "a5e8609cfc6db4f7b184c920dbd795ca.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919246f1-93f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617395130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617395130, "uuid": "5185cd5d-9b51-4c7e-ab45-d77b319a1a63", "comment": "Malware payload (njrat)", "value": "27c64ab93bfb9bb8c8151bbeca141655", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617395130, "uuid": "6f7d9bb6-59cd-4759-8d1c-6e2462b3c79c", "comment": "Malware payload (njrat)", "value": "91a51c0ed7c1cf2e5d3fdb73e6f99e13745f036d5bfbf6d8df47df154eacbf37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617395130, "uuid": "7d8e9539-7a44-4211-b109-b109abac64b0", "comment": "Malware payload (njrat)", "value": "5836252d680cc35dcb6c815af1f753140c100660", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617395130, "uuid": "fa1b44d5-e8e0-4c04-a0e4-fae6be15fcaf", "comment": "Malware payload (njrat)", "value": "ef783e3198d57fd18ea0a1c09c1f5521f0023f2ba487a9779f8ce7f54ac008d5fc14bd1dc7ac8bb909495ed1a6e2b2b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617395130, "uuid": "c605d741-8b09-4cb2-bac0-9bae3b71301f", "value": "BA84B409AF6B9A95C29D82F9E0014051CBFDE690A94FF3CD18C5B9F03457B3A1DD29A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617395130, "uuid": "1b808a11-5d9f-47c3-a6c4-cb0168192975", "value": "6144:0bTP9U02w4QeRffd/pcL6pynUVg0Dr769mxXf+hC1W+/psvCC1amK:902w4QeRffd/pcL6pyUV5DNtm4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617395130, "uuid": "43f85262-bd09-462c-ae00-5e0b37e85849", "value": 382976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617395130, "uuid": "8ef3ad14-f95b-42c1-8390-11f76f5d9cb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617395130, "uuid": "2af4b0bf-92db-4b08-94a6-dd379dcd45dd", "value": "27c64ab93bfb9bb8c8151bbeca141655.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b7e1c0-93b1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617367548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367548, "uuid": "f3648d06-f271-4ac4-9774-326440fb4fc9", "comment": "Malware payload", "value": "20c02a4fb1b8d09ca481a0c9978a09b9", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367548, "uuid": "85c738cc-03fd-4412-b638-a220bc1b8bfb", "comment": "Malware payload", "value": "92346016de2f6205e39fd6d8376ad46a48e6b55e2b28067431587727c70ac8a0", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367548, "uuid": "7806d827-65ee-4197-8120-50fe3de66e97", "comment": "Malware payload", "value": "0874897c1ee2aba5deadda94f0ee721b6204ec4b", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367548, "uuid": "61923bae-d36c-4fda-9c63-3e0ffec67fdc", "comment": "Malware payload", "value": "b8e8a59b39344ccf5c0f1c04bc158951cfbce91c629112766ab1e7a1cb9f871d029684675db4021b68f876bec3461532", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367548, "uuid": "75eefa09-1fc4-4b92-b7ee-eb104a1a4557", "value": "B6E42369A855A39143CCF3158E78DF02898F5C22AA103BB45F5F3AE47A1117238DFF89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367548, "uuid": "a177aa55-7fed-463c-a6bf-887c2031346b", "value": "12288:0o0WDMvU2dLOj1gT4fZhSEnGeFD2HIibmzUR5997oDY+RTDvn8CxjD8+EdDdRYcY:0o0fL9MfZhVFKfKU/9poDxTb5hCdLCky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617367548, "uuid": "3c7edc98-82df-4cbc-bd2f-eab411d4713c", "value": 718522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617367548, "uuid": "c3bc1b99-ab47-4967-8ba9-4c667137a510", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367548, "uuid": "554e165b-3cb4-4395-b01e-ec95e5a17b39", "value": "MT103_pdf.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "868b6666-93cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617380508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617380508, "uuid": "818f85fc-bc3d-49c0-9178-d70357bf168a", "comment": "Malware payload (IcedID)", "value": "314541a217daa9cf493c3114338efaca", "object_relation": "md5", "Tag": [ { "name": "GoDaddy", "colour": "#EB23B9", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617380508, "uuid": "4753cce8-72b0-4a82-978b-96a7ce747485", "comment": "Malware payload (IcedID)", "value": "92bec15bf3f49cd2a287d9e28f8a680de0323939bcdaa46f2566a84d750b9b40", "object_relation": "sha256", "Tag": [ { "name": "GoDaddy", "colour": "#EB23B9", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617380508, "uuid": "9576ccd8-7514-4793-b4e7-fdc521567206", "comment": "Malware payload (IcedID)", "value": "16552285edf33d7e7d3125ce75ec4a6c91993e67", "object_relation": "sha1", "Tag": [ { "name": "GoDaddy", "colour": "#EB23B9", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617380508, "uuid": "e6bcb6d6-a438-43f5-a4d2-92ec25d45dd2", "comment": "Malware payload (IcedID)", "value": "da30555da640d6adaf759e4dbdce5c7f937c10732ae07114ded0794a49182231cb53c00cbce3d4dcf164a74a667d0dfa", "object_relation": "sha3-384", "Tag": [ { "name": "GoDaddy", "colour": "#EB23B9", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617380508, "uuid": "12ef388b-c730-4271-9e51-941a07ebca31", "value": "EF04123CD03A8D58C2A5447BDC1CC259AC6A2426ADF4F4AE7188B598DB532F31F6FB44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617380508, "uuid": "1792ea44-1021-4d64-be2c-b85f3f3f3141", "value": "3072:llYXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGj:llgE5SDvbXAyHbVt15wTQDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617380508, "uuid": "2a2724d2-1039-49ee-afcb-751b0f2ad4e6", "value": 178551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617380508, "uuid": "ef1ee21a-c33e-4b4c-9e1d-24236badf506", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617380508, "uuid": "64982a83-dfd0-432f-b11b-35c557c10e2d", "value": "9556305403-04022021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5fcea3f-93a2-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617361288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361288, "uuid": "3c3da103-8a77-43a5-af66-f8fe1e0c0436", "comment": "Malware payload (njrat)", "value": "a4c5b6be44e18dbb2261008c7cde9fae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361288, "uuid": "0a603259-4229-4609-90f9-154c2ff86a0c", "comment": "Malware payload (njrat)", "value": "933f58108b827bfce28b867494cc5bd0b46c63d8473fda522e9510f38d53612f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361288, "uuid": "54702f36-19c1-4bf6-a193-cedccd2a38f9", "comment": "Malware payload (njrat)", "value": "775e2f78f7dda208c3b09ca3f2259e50005f0743", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361288, "uuid": "1690ace4-6d1f-4ec1-bc18-70c0da63c79a", "comment": "Malware payload (njrat)", "value": "10daeaf3448359b61dc02ded1ac7b330120b6a01cf7bdb2974e0d410f9f2bc238fa8d18a661c1fc2961e658c606037a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361288, "uuid": "a46178bd-e514-4640-b5b0-0134f6bff3cc", "value": "C174DFF13994DBD5EA390BFB560424410BF8E7EA4413DF849D89E8E62199F0D0CDAB87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361288, "uuid": "d190ded7-359a-4249-a208-b5d1cc828c70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361288, "uuid": "af99c3d8-d1e9-4071-b0ad-52d21cd2c18f", "value": "6144:CZ7w+9lqYTsvpQSTaw6xo2sU29jp4B7yOchGgn2N+t:AlqJSSTg3BjB73chGOtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617361288, "uuid": "437b2736-92ab-4726-b97d-50d5fae9e189", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617361288, "uuid": "7a0d9cc9-602e-48ee-a56c-c479bca26c99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361288, "uuid": "2b638f05-1ef6-416e-802d-076bfe4d53b1", "value": "a4c5b6be44e18dbb2261008c7cde9fae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c49f03ef-93b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617367728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367728, "uuid": "c3ec40db-363b-4ca9-94f5-eb5df43c26e6", "comment": "Malware payload (IcedID)", "value": "8c4513c7ee24c7389b2f14503ccdf93b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367728, "uuid": "bb6b3904-926d-4dd8-b901-7652c478a161", "comment": "Malware payload (IcedID)", "value": "93f130256dc72d15bae56f68a552e02cb7dccf38f9fe5304e31d717879b09051", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367728, "uuid": "201dbb2e-4bc3-4a88-88f4-6a8bcd406d02", "comment": "Malware payload (IcedID)", "value": "c6df1add4e54d387b32586314c23ac03aefd2e44", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367728, "uuid": "ec59b225-4c69-48b0-9efe-c2c45cf77805", "comment": "Malware payload (IcedID)", "value": "ae8c2ca96a546576913a9810e5f4af2ca0b49841dc57cdccc47e7b403ef91f769ea83d92c5bcf07a33dedd3ae74eaf22", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367728, "uuid": "8d316cb9-f1de-4f5a-a144-7b263fc7fbd6", "value": "5E04123CD0274C58C2E5447BD858C246AC6A2427ADF8A5ED668CB994EA137F30F7FB44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367728, "uuid": "a170566b-90e9-4f11-a4f8-c5e3b971c88f", "value": "3072:PXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGDKJj:vE5SDvbXAyHbVt15wTQD0KJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617367728, "uuid": "8767fdd5-63f6-4a7a-8200-a20bcb0470ba", "value": 176993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617367728, "uuid": "4a1fed19-5534-49bc-be57-ab5863574167", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367728, "uuid": "95a09a46-2b03-47c7-aa85-253d385aca0d", "value": "9642351931-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874d7386-93e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617388241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388241, "uuid": "3f46023b-4471-40aa-b5e7-31314710b026", "comment": "Malware payload (Formbook)", "value": "df10e72e8acad3114eccb16a1318632a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388241, "uuid": "6bde65d7-8867-4457-96b5-30e007724460", "comment": "Malware payload (Formbook)", "value": "941b1e6078270fd2ee6d1b48d839c0e594229092f1e717f392163826f60b566a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388241, "uuid": "1907fb98-662b-4616-822b-5cea35f340fa", "comment": "Malware payload (Formbook)", "value": "f1e11cbd35f0a23e0b0612cfe18eaf6f3e2038f6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388241, "uuid": "5c5a7417-929e-436c-a18b-352bd9ef2aa4", "comment": "Malware payload (Formbook)", "value": "4df433168cfd91cdf06a851611582a2919630d137934c6e3d130bb505fd721baf11f887bae9fad5b4e118a868a527c83", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388241, "uuid": "34360b09-b7f4-4dd0-a029-66f1c951dd65", "value": "7A75819C3A50B2DEC837CE758AD85CA4EA9029F7470BD157A09707DBD91CB86EF050B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388241, "uuid": "43330dc3-6d3a-4951-9678-2428f9260d49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388241, "uuid": "c16f2721-c725-41c6-8396-dac883a626c9", "value": "12288:6wtFY50S7sJqIE3oMnrStOZUtxciiBS+PXYdhtzvayTF9HGHtUk6H+Cewf1n4T7K:tEHBAdzuW6Uk6eCPy1/j/d9fXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617388241, "uuid": "aa8368d7-e262-4002-aaba-8dbb71efd0f9", "value": 1569280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617388241, "uuid": "672952bb-354d-4aff-852e-9ecede25cd7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388241, "uuid": "3ab909b5-c06b-433a-9fbc-b8d70781f026", "value": "BL COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256afd1a-93f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617397955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617397955, "uuid": "7baa1de1-0770-4889-8493-b7f4442991ce", "comment": "Malware payload (Dridex)", "value": "9b7628e220cffe310032933b86b1eaf6", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617397955, "uuid": "7565386c-2bbe-4cfe-9712-568dc6cc6ad9", "comment": "Malware payload (Dridex)", "value": "958d27940d75164c133c95181eaab13ee9f1e6556421f2dfc09097cec4f5b94c", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617397955, "uuid": "faf9628f-d9ee-41ec-b4b5-fb596414bbeb", "comment": "Malware payload (Dridex)", "value": "9286d84a3556bd58a008a88a1db229c83d305330", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617397955, "uuid": "5124f5fe-99cd-4a3e-ba76-bf59a8a671a6", "comment": "Malware payload (Dridex)", "value": "14828035708b8afdc9cfc85922b16a6ca80eebe9a03be1a1a18cb4ba4c4773ba49a0cd4c7355329aff9749ab34c404ed", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617397955, "uuid": "2983aacc-2873-455e-a8c5-a4982c0bcf60", "value": "8514BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617397955, "uuid": "2e6ff0ce-cebc-4fbd-abb3-618848a9e8be", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617397955, "uuid": "7ca19659-707f-41d7-86d4-f44322f48159", "value": "3072:/opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:QpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617397955, "uuid": "6f6bb211-6321-47c8-82be-0e0acbfabef9", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617397955, "uuid": "6741e7e7-753e-4a5c-8ca1-cdf03fd99022", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617397955, "uuid": "19e51dce-999a-44db-9e87-f5860113f6a4", "value": "958d27940d75164c133c95181eaab13ee9f1e6556421f2dfc09097cec4f5b94c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30009d0e-9397-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617356311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356311, "uuid": "7e9ebe45-54d2-4567-bdf8-b3727b446e59", "comment": "Malware payload (IcedID)", "value": "c73d3fda8902766e09951c7bde6ccc48", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356311, "uuid": "93ff825d-ed45-4e51-ba0e-03ac61ecf2bc", "comment": "Malware payload (IcedID)", "value": "959d01ef11ba76ddc7942c39d4c017b63aa26513f0d2fac1b8d8bfcb97373e23", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356311, "uuid": "026cdadf-522e-40a5-853d-bd953021df4a", "comment": "Malware payload (IcedID)", "value": "73a0f8ec2cb1a2811ded18d1ae6adc54273d655f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356311, "uuid": "41d5de52-7590-4620-9b72-d7dccd7d79f8", "comment": "Malware payload (IcedID)", "value": "0423d5b7387863bd0048718f620264e41d7cc6e5827b966ddaae34316bffc3808877ae7f0ea5ba0b7636ef5031f2f09d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356311, "uuid": "a2512619-04a1-43ce-9ca2-1083432291ff", "value": "2C14F7935CCFB663D42F50F1A8A1647D7F30BCC413E297DBA9084B1AD993792A972318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356311, "uuid": "0dad73d5-5fbd-4b18-beba-cb62c9b6e09f", "value": "3eb5471c5370e4bcb3be6637e4995a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356311, "uuid": "ef32e25e-a07a-416c-977e-b1675c5909b0", "value": "1536:Vq8ByBeZnwLGM+NoV1XjeNSaziIz7Ja5j/Nj/IXoZcq+M6qaCZZtr2wS+FJZLT:Q8+Kjv4RECZnrDSGZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617356311, "uuid": "3707018b-575e-45fe-a125-8c9aef0e1b01", "value": 203808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617356311, "uuid": "de6e6da6-953b-42a2-811d-6e874bad2384", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356311, "uuid": "b4b32635-41f2-4d31-b73f-1c02f3273c7c", "value": "959d01ef11ba76ddc7942c39d4c017b63aa26513f0d2f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0299dd1e-93de-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617386730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386730, "uuid": "ba51fce4-33b2-4253-91a9-ec5d4b15cd6c", "comment": "Malware payload (Dridex)", "value": "eeda831f58f9f8eaa9bd74a5db24a834", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386730, "uuid": "32140830-c4c2-4eb9-9c00-1c677d45e655", "comment": "Malware payload (Dridex)", "value": "95c3891ec9114f02befabf98d3ecf628e4de4483c4107430fb02f42030236cde", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386730, "uuid": "682d52bb-60cd-4250-a5fc-74cff2b9aad1", "comment": "Malware payload (Dridex)", "value": "1e5222a5ca636a19b4bdfbadca0b12076bfb8c0c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386730, "uuid": "62c3b9d8-d66d-49bf-aa97-39b1334fb9b0", "comment": "Malware payload (Dridex)", "value": "07c11abc62c3733603507653f58862107e8620f461e0aa2279fd56730b740d22265f877c78745755d203c46a7e967582", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386730, "uuid": "59603395-d090-48e8-bc7e-d71428c2ce15", "value": "3214BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386730, "uuid": "5434624c-d5be-4c89-ba84-3d4881763a5f", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386730, "uuid": "fd3330bc-0ec6-4a04-b2b3-bc3f4831d553", "value": "3072:oopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:fpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386730, "uuid": "f57d98eb-deb0-41c5-b0d3-53d7b50af2bf", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386730, "uuid": "775b0f8a-2698-4436-a5a8-d9e1c5441fe7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386730, "uuid": "54c3844b-6d15-40b0-a537-f37bef1b21f9", "value": "95c3891ec9114f02befabf98d3ecf628e4de4483c4107430fb02f42030236cde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d835c8-93b2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617367882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367882, "uuid": "bfaa2dd2-10e2-4735-bd81-deadbde899a5", "comment": "Malware payload", "value": "04cf25e86f86defec55cd0784193e0a0", "object_relation": "md5", "Tag": [ { "name": "netmon", "colour": "#3012C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367882, "uuid": "cf5e83d5-73e5-487d-b62d-ef58c89017ae", "comment": "Malware payload", "value": "95c5c28ef18bd0e82582e576ef1f1143d90dee0eb80bb69bd9c16627f32f35c0", "object_relation": "sha256", "Tag": [ { "name": "netmon", "colour": "#3012C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367882, "uuid": "8a300548-8185-4a67-bdea-f09fd9e8eb15", "comment": "Malware payload", "value": "efe3e5b90af7bac1dfb9c597f5c5d7183785660c", "object_relation": "sha1", "Tag": [ { "name": "netmon", "colour": "#3012C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367882, "uuid": "5cf4c6b1-b1e5-4b3d-a34b-9e3c17145de8", "comment": "Malware payload", "value": "7330a6bfb81abd0294995a1bc56a7d7ae36d6d56a1c4e3c06fc1cc2d734e89b2b31ec985665e43c31b29c076c92ce318", "object_relation": "sha3-384", "Tag": [ { "name": "netmon", "colour": "#3012C6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367882, "uuid": "e151c6fe-3364-49f0-b23b-b98b178cbdad", "value": "3F83C5493BE5AF93D2AC6F38E0E3034063B5D2387E16F70B4A94853E6D427A75C91963", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367882, "uuid": "969026f5-196d-4df7-8380-81b9fc6f1ffd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367882, "uuid": "a579d817-ac1b-49d7-a854-b452e056bbf1", "value": "1536:7UtjUxfyWwUp52TAywTTaQnafAh76NB5ty5YHn7Sxl:71xqWwUp52sCA76NeYHn27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617367882, "uuid": "65b6a35a-d3a7-47cc-96ba-df25fc0c0416", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617367882, "uuid": "b98beb43-2caf-4eb5-bbd1-75519c8d335f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367882, "uuid": "f2b777b8-fc91-4d4d-a860-0d359bd9c44c", "value": "netmon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae02ea3f-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617386588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386588, "uuid": "e0bafd94-38c9-415e-b23b-224af634e054", "comment": "Malware payload", "value": "3484b25f2ba1dbb96d27992e52a1f042", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386588, "uuid": "9838cdc7-96ad-417c-a67e-3f04fbeab4ff", "comment": "Malware payload", "value": "97488be036cb1cf1a500188d3449062f4f10d83afb57630a8f6497edb196dc21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386588, "uuid": "0c661fc7-23b0-451f-9d92-93bde9e85084", "comment": "Malware payload", "value": "a1b3a2d9986bb7b4ee2a6e32be4b0f211213a0b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386588, "uuid": "c74280bd-d372-4e7f-b8a8-99b01835a4ef", "comment": "Malware payload", "value": "9655061ca02754d1dc1e0ce69e57c4c5a53fc004ffcb9f2874020f021733d75f734bcb0885f515e1d0bacccb0110e68f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386588, "uuid": "5349a9f6-8f9b-4907-aed4-e859e1146c48", "value": "67E4C033F0C2C07ED0321032596CEB6259BFF9320A25499BA3C4156E9FB57D29E3665B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386588, "uuid": "d7bcbcee-36cc-4ec4-aec3-94abcb47ec36", "value": "2a908babc5cc3af850e078751d7de0e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386588, "uuid": "c1d1de06-65ce-4b35-abfb-a9fa69f79cbe", "value": "12288:VoJqNIPtNmO6IOOEp0TMlja7NRl2PSVikIyoyueh+AkHcnLwuukoCOD6zlmjOz+2:VoJEKZ6IEGTMxapRl2PSwHTehy6B1+p4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386588, "uuid": "4e810671-3fa8-45ac-b9f1-babfc9408500", "value": 698280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386588, "uuid": "4f5d09c2-1e02-4d1a-88cf-c9fd23b3a1bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386588, "uuid": "ba1fb09a-a943-45d6-a5bc-efb6b81de192", "value": "3484b25f2ba1dbb96d27992e52a1f042.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b57d26-9355-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617328033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617328033, "uuid": "67cbfbb6-e354-4ca3-ad30-03d9b7836b85", "comment": "Malware payload (Dridex)", "value": "30d435e6f928223a1617545fe5051bfd", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617328033, "uuid": "35d061d4-24e5-4c4f-a2d4-8e886b548875", "comment": "Malware payload (Dridex)", "value": "9866c13a53b33c4b0d95635ed5531738679fc37ceab6284ac0e76ee863387005", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617328033, "uuid": "13a655b9-1acd-40c9-b391-f449be924d16", "comment": "Malware payload (Dridex)", "value": "e366f169433c6fa981d23d415386b643bcc4f73c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617328033, "uuid": "10c483d0-4aef-49b8-85b0-877bc201a021", "comment": "Malware payload (Dridex)", "value": "d12e8eac7c59ae7c83ca5b0b549183ec8d658baee03543c7ca5b00d853ef46c2931d78f79bf146e0a7ec5717158c804b", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617328033, "uuid": "fd6f312a-a9fc-477f-9b01-755fbfc4d35d", "value": "5814BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617328033, "uuid": "340fe697-48a2-4738-bfc7-b9f8ddd2b355", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617328033, "uuid": "2f0d4900-025a-4d59-b6f5-0b48c42d06cd", "value": "3072:Iopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:/pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617328033, "uuid": "7accdba7-5e8e-4f5c-b09f-b3c8a937c8d6", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617328033, "uuid": "5f6a93a5-13e0-4a16-9907-d4385a93c892", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617328033, "uuid": "0d0c869e-f1b1-4217-b355-6d9f17cb4328", "value": "9866c13a53b33c4b0d95635ed5531738679fc37ceab6284ac0e76ee863387005", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82315c6b-9396-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617356020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356020, "uuid": "95222800-90ab-4d0e-8ec6-72c8804ab0c7", "comment": "Malware payload (SnakeKeylogger)", "value": "8585caf72a48aabcfd71156fb21de98b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356020, "uuid": "9a079a92-ae8e-4850-880c-b805218fe139", "comment": "Malware payload (SnakeKeylogger)", "value": "98fcb80511e83129d9b1bc780418f705f4d491b0fc240b9d356d0ae06c7eb9ad", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356020, "uuid": "cb77b624-1808-4804-9afa-508656fef2a3", "comment": "Malware payload (SnakeKeylogger)", "value": "235c3bea91197cd2c9e8ff29f28b1fd55fdf5033", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356020, "uuid": "a7c47066-00b9-41ea-83a9-04799fdfa481", "comment": "Malware payload (SnakeKeylogger)", "value": "54fdaef9ea79c0b0e3f6ba9a2fe3fe0d154120654c9f5535f01013cda3e76f729a62df31469216c661ebae72f3907f39", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356020, "uuid": "d79a35d1-213f-4eb3-b807-e69fe01d47f1", "value": "13C423D7694AE8087735328BE806B6734D4C1891C1222F17F8FF38E65D3EE78579A188", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356020, "uuid": "2cc13ae4-9792-44aa-9584-c1b306168bc3", "value": "12288:51EVzq8i7U+oXXmDWhHp78yC3bUWCyMD0sk7hxs9rzOHd9:AVB9jnmDWr8DCyMDmxs9299", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617356020, "uuid": "2a3b906b-fd04-4829-a8b8-9c189771a6cf", "value": 580280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617356020, "uuid": "a143e291-7aec-46d4-b65f-3cbe50a4d8c2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356020, "uuid": "2b8376aa-048b-4694-a8a3-4cd1cc7f1b7f", "value": "FACTU090089000.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed643a58-93a8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617363931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617363931, "uuid": "13315458-f7aa-43ba-9363-36d0d8807511", "comment": "Malware payload (Dridex)", "value": "e684a38793474b23c19a377ce96713d9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617363931, "uuid": "67bfe68d-c655-4ebb-a884-8012a85b0dc5", "comment": "Malware payload (Dridex)", "value": "99f79a78fc8fcb6c3aec5910d326f10827ec167d700790ea63a6668510dfde8e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617363931, "uuid": "9f258ec4-03a8-4abc-9442-81a543cd4f62", "comment": "Malware payload (Dridex)", "value": "6fb946b044e9c3c4594606ad9f48f1c1397e39f6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617363931, "uuid": "fb4d8411-d540-4d54-9b75-2c2947832dab", "comment": "Malware payload (Dridex)", "value": "600190567ed66949140c1b93be690bb40a30a1c569874a5b0448605bc6b2eb69af00e04fee181eefcdc84afc07d73f9c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617363931, "uuid": "195bc27d-1d03-45eb-a779-12d8c3fd8b60", "value": "22248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617363931, "uuid": "67c5ab1a-48b6-4d4d-bc14-f75b93dfc171", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617363931, "uuid": "5ac5d4ee-7e25-4c3a-9feb-0391e6330494", "value": "3072:T6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:ToMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617363931, "uuid": "667d6fed-5497-469d-bd44-cb3997d16294", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617363931, "uuid": "a934c545-25a6-40bc-8b50-4e85047889ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617363931, "uuid": "66f0de43-12dc-41cf-b25b-52279c1bae5b", "value": "99f79a78fc8fcb6c3aec5910d326f10827ec167d700790ea63a6668510dfde8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f87f98-93cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617380506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617380506, "uuid": "a300ab21-c72c-44d3-ba09-95da0a3040be", "comment": "Malware payload (IcedID)", "value": "c9ef8b258ff628d6fdaf4a6ad152495d", "object_relation": "md5", "Tag": [ { "name": "GoDaddy", "colour": "#EB23B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617380506, "uuid": "83e00510-9ece-43bc-97cd-bd818ff2c61c", "comment": "Malware payload (IcedID)", "value": "9a42cc7c0241a3544e5433a8eca6b261cfe8f2a8cba36c4c9036621bd234c073", "object_relation": "sha256", "Tag": [ { "name": "GoDaddy", "colour": "#EB23B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617380506, "uuid": "f292e329-0534-4a6a-9281-7e01c6318035", "comment": "Malware payload (IcedID)", "value": "e76934dcd99a5c90582f019e844962c02ebb8365", "object_relation": "sha1", "Tag": [ { "name": "GoDaddy", "colour": "#EB23B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617380506, "uuid": "0f140782-515c-4061-b098-9ef70168cca1", "comment": "Malware payload (IcedID)", "value": "85877b1e8a6a399f499731eeb9bc9cdbe7dfbb92c0fbc345ab6f42322204cc56b5cd7bae4a88ab79bbc1221ae56cdda5", "object_relation": "sha3-384", "Tag": [ { "name": "GoDaddy", "colour": "#EB23B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617380506, "uuid": "f0de83b3-393b-4ccd-ab68-de5d03d2aab1", "value": "0E04122CE46A0D9540DA94B7ACB9C1099C772035FEFC55ADE25C3DA4EA636F20C72F04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617380506, "uuid": "53c1b676-21e9-4eb1-a305-2774c9bba0d6", "value": "3072:FndZ9A59bUDE3ZS4yvYCidynhV512A7bP8m1cNwKw5RKiEfTcD+c2l:FnBA5aDZbzSyTbBN1RcfQDMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617380506, "uuid": "6365d642-6d08-457f-b322-f5ccf080b0eb", "value": 174251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617380506, "uuid": "1c361a6a-a183-41db-8081-b022993537f3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617380506, "uuid": "4e49b13b-ff97-4f74-9453-e7241b13c53c", "value": "9556305403-04022021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d663335c-93a5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617362604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362604, "uuid": "92da25e2-7db8-42c1-ae87-0925dd7f5c9d", "comment": "Malware payload", "value": "d55e772e2cc89e3420a5676f083eb089", "object_relation": "md5", "Tag": [ { "name": "151.236.14.53", "colour": "#BB80BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362604, "uuid": "c6fb9e70-9f90-491b-b0ad-3736817a6ffe", "comment": "Malware payload", "value": "9a7173af1be30b406de5f5ef2a41f0510a8bb0abed67b6bd863a624acd8c1f41", "object_relation": "sha256", "Tag": [ { "name": "151.236.14.53", "colour": "#BB80BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362604, "uuid": "f31e7fe5-5427-4a27-b585-a9da1f2fb0c0", "comment": "Malware payload", "value": "96169b831a80795adc864c7aca1d7fd3121c77b9", "object_relation": "sha1", "Tag": [ { "name": "151.236.14.53", "colour": "#BB80BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362604, "uuid": "77b4696f-f85e-499c-b0ae-472abab8b30a", "comment": "Malware payload", "value": "b8b2e91a00847585b01059fe37d589cff06f6e7440a5de379f2b4538488ad15201778b182a19f83bf0d1223f519b6707", "object_relation": "sha3-384", "Tag": [ { "name": "151.236.14.53", "colour": "#BB80BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362604, "uuid": "15ce3047-de28-4631-82a5-00c2ae3b6622", "value": "72B3BF37A68D8A05F2B18831468FF7309CABB510DE45E183F2DE5ACCDA60115E5DA2B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362604, "uuid": "5b683c11-1ef5-4db1-b6e7-7e9b3f6fd19a", "value": "6e55c1966a660edc0d909805e6a79c80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362604, "uuid": "fcb49982-f50a-4abd-bb8b-a23fabe28a69", "value": "3072:xODlZaKTssYAwY7KfLdXqjNHVUkPpOeOx:YxAiM7YWfZ4NHVDHOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617362604, "uuid": "0fcf24b8-09e3-49fc-be4c-8e290bc6bd35", "value": 107520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617362604, "uuid": "8b19f835-61ca-43c9-a0a5-718c183146fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362604, "uuid": "64cac442-7701-43fb-8bbb-f2a504ea6e67", "value": "9a7173af1be30b406de5f5ef2a41f0510a8bb0abed67b6bd863a624acd8c1f41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e909472a-9375-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617342019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617342019, "uuid": "5c3d036a-906c-4aa1-91d8-c5d882afddfe", "comment": "Malware payload (Dridex)", "value": "6c5d67a8ee82be71b888f18679e94b01", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617342019, "uuid": "2818a62e-9add-4814-8a3c-424568b54277", "comment": "Malware payload (Dridex)", "value": "9a987f7311ed9146ed6ecfb39f8e43f9ed725174bed5c6e07d4a103e260ba289", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617342019, "uuid": "1993954a-d108-41af-97a6-ab5f02747ee0", "comment": "Malware payload (Dridex)", "value": "a58c8393ea173b27fd10084541647ee60e2457dc", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617342019, "uuid": "91e37b6a-22a4-4796-bdfd-a3e6834fd187", "comment": "Malware payload (Dridex)", "value": "af3c96fb587c6321ea91b19ea65e4d9973583f48c24f4d83d245a89f278b36e9324a58748147860b161643837e727940", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617342019, "uuid": "7e44ce77-0065-47df-90e4-4a8b1c5a211e", "value": "43248C5FE339E486FEE3CAF44186A72296A39C92476F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617342019, "uuid": "6adc324d-b017-47de-b7e5-2b6f6770c0ba", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617342019, "uuid": "c75d945c-b078-4e77-85d1-6972a85bb217", "value": "3072:k6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:koMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617342019, "uuid": "a4221be4-9a63-483f-88a6-5e09209e85c8", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617342019, "uuid": "a8f13914-c1dc-45e7-a209-11a537f800c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617342019, "uuid": "920a0107-d90f-41be-86a8-bdfd6ee9eae9", "value": "9a987f7311ed9146ed6ecfb39f8e43f9ed725174bed5c6e07d4a103e260ba289", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca0976e0-93bb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617372032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617372032, "uuid": "327d4371-6fab-44b7-9f85-1cfa50674d45", "comment": "Malware payload", "value": "ffdf90260dffba5b625b919ede9b99cb", "object_relation": "md5", "Tag": [ { "name": "MailChannels", "colour": "#06A016", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617372032, "uuid": "efff9691-eaae-4319-8c77-e125964de575", "comment": "Malware payload", "value": "9b91fa478c405e3d908ddb94bcdaca93da94d078b523a696d1ef05fdd3fff522", "object_relation": "sha256", "Tag": [ { "name": "MailChannels", "colour": "#06A016", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617372032, "uuid": "55571bed-9901-4ec4-b2da-366bcc1f7e08", "comment": "Malware payload", "value": "5821ae703165307276de2753b4fc609f1e6aea4d", "object_relation": "sha1", "Tag": [ { "name": "MailChannels", "colour": "#06A016", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617372032, "uuid": "17d6732d-691c-428c-965f-5b2ab46c9012", "comment": "Malware payload", "value": "bd8e644abb93fedb02141cc395bde9f064e1c78e7f2852ddfd7ba96df744189932738f96a107d8023e0e1f6d67f7ce08", "object_relation": "sha3-384", "Tag": [ { "name": "MailChannels", "colour": "#06A016", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617372032, "uuid": "8f847357-31de-46ca-9f4a-885f3add1411", "value": "DE7302FD7935AFB48A133FA746D220664592F1826445E7BF6F622934D03029610FBE1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617372032, "uuid": "2c19c460-a5c4-46e4-b1f0-003f6b44569c", "value": "1536:e/kFWtwP5dNWpBC5bQ+N8Y6ofw3ol4bX2gRhe4bfjXCsF7Zq8g:qe0wP9ucnZw3oImWhemyyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617372032, "uuid": "128d20bc-2388-47df-b496-c789afb92209", "value": 73869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617372032, "uuid": "a38f3c88-6f90-4749-9896-5809079b2028", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617372032, "uuid": "1645e9f6-2de6-451e-b31b-317b2af089e8", "value": "catalogue-62.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508f3ea1-93b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617368821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368821, "uuid": "59a8ec1b-88be-4106-84eb-dc7147bde008", "comment": "Malware payload (Formbook)", "value": "e4a1c511cabce0355351fbdc36a12a4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368821, "uuid": "3f62dfba-6aaa-434b-bf25-5428af4c1a09", "comment": "Malware payload (Formbook)", "value": "9e23de70acc475a483df75190ca88ff14395f99074f84c8eb86b4eadf523e498", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368821, "uuid": "aae1842d-155e-4719-90fc-02857d78e37e", "comment": "Malware payload (Formbook)", "value": "70b05eb02925a7373903b4f984e84312e4be1268", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368821, "uuid": "e54cc59c-c691-41b4-bb5a-0e2ff2de4a13", "comment": "Malware payload (Formbook)", "value": "be112fd3bf37a49cb2ff8282f6f2dd590edf813b9096e5b5a82c1c7801d22719c2c18050592a93b724b22567dedb0833", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368821, "uuid": "ddcc1471-c421-4703-9d6a-d296caf46d36", "value": "B7842B78512FC419C9624331B456C530AED6ED0CA5A04FEA16B8F1FA2A31FA35DE742F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368821, "uuid": "b0f18b80-26cb-45af-ab64-ecd7822ba452", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368821, "uuid": "f79eecf8-e600-4206-97dc-b1eb7bf0f78e", "value": "6144:T9X0GzpWF0jXZYUWpQUY8ticdKooiYDO+MfnjCrWVV2:904WF0lYfbYLouLMbCKVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617368821, "uuid": "9654dde7-4cea-4937-97e8-e41df3290e41", "value": 380890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617368821, "uuid": "e8cb8d8c-d61a-48f1-aed3-4febd7c89802", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368821, "uuid": "edbfdb16-0059-48a6-9acf-18e6cb8df852", "value": "ORIGINAL SHIPPING DOCUMENTSPDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1718f0c8-93d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1617381610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381610, "uuid": "208b7e47-bc03-4e98-ab02-ada0f9429137", "comment": "Malware payload (STRRAT)", "value": "352d0507cd1f90ef844f3adbfc77c14c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381610, "uuid": "cfe27508-490d-4ed0-a270-dea5d8c429e7", "comment": "Malware payload (STRRAT)", "value": "9e7cea98f75591fadfc70417446fd266d9330be1c5cc04055b89d908954c718d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381610, "uuid": "0b1a3640-4806-4f0c-9864-a587a6bc24b3", "comment": "Malware payload (STRRAT)", "value": "22bbf80c7004f64bfdd1fb9bdd14bf96f8ec93f7", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381610, "uuid": "18f8a509-c805-471d-83d7-8900253f7ed8", "comment": "Malware payload (STRRAT)", "value": "68b0eb615d4514040c93f5304b580b8ae0a69dbf91604ef1fd523aafe1a38e61edd9ee0a6cacdb51335146e1893aa8eb", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381610, "uuid": "62a4533f-512e-4817-8a64-4d9a04eaaec3", "value": "D5F312B4531E562242C76AA7C39BB49803621378C676F10F02ACEF2F6725A554D38FDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381610, "uuid": "d17f4433-4c64-4f58-889e-8d8a20c4ff59", "value": "3072:16wvRg5dN3E1zhi1UyE5RxxXAGfe8Vgs4C6XK1LxfI5PvlvC1Zy48iSZbSUHmd6:1m5dN0VhVTXAG7gs44dxfkdvCa4Ri/mM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617381610, "uuid": "67a20dbd-7e55-4493-bb36-7d5c97c9e79e", "value": 172499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617381610, "uuid": "d2a9399b-e8c4-43bf-aa88-58295de32d29", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381610, "uuid": "0823a9dd-bf00-4860-88c0-bafd7b811fff", "value": "New Quotation Request_1109 .jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e603b2-935f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617332265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617332265, "uuid": "ead34808-d047-4911-bf6e-10f72b9cca00", "comment": "Malware payload (Dridex)", "value": "1da53e1796e3281f032a42b09e2c8e5d", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617332265, "uuid": "cfff77d9-cb17-4dca-b8f5-be6a8b8f0680", "comment": "Malware payload (Dridex)", "value": "9f726f8135616af397a3dce5f0360e7d89678eb73e63c95f207b483d7df0f8f7", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617332265, "uuid": "70f0f491-19be-4a56-92ef-a6bc3169a061", "comment": "Malware payload (Dridex)", "value": "61b85490d376e906fb20164e60dfd2c0d08c3297", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617332265, "uuid": "9a3e2d33-fc04-4ec8-be6f-e5c5793592a2", "comment": "Malware payload (Dridex)", "value": "d69255a564a898d8da46a5e5f24763e07f62effe489dc11b65ede8ba74b340495809ad9eebb2bf0ec90abb205f77baf2", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617332265, "uuid": "7a053cd5-2d6d-43c7-91bc-4a2ef1d1cd69", "value": "EB14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617332265, "uuid": "73d0e8f6-5ff0-47ed-b39c-3a18887d1747", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617332265, "uuid": "3f832f19-43cd-46af-b8d0-cbc3348fbdf5", "value": "3072:Gopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:ZpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617332265, "uuid": "5a83df83-133c-4ea7-bb34-50c8a2fd0871", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617332265, "uuid": "56895cf1-b38c-4894-af7b-e7022b18c06b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617332265, "uuid": "66e73630-737a-42bb-b799-cce8111810e2", "value": "9f726f8135616af397a3dce5f0360e7d89678eb73e63c95f207b483d7df0f8f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f89716e-9370-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617339533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617339533, "uuid": "bef55c7c-193f-4e0f-a6a1-ee90af1a41b7", "comment": "Malware payload (Dridex)", "value": "90889d97c85c49aece6ea30819dcedc0", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617339533, "uuid": "d00fa736-ebc8-4ab4-8732-e5b62f478319", "comment": "Malware payload (Dridex)", "value": "a0c84d325eebbb6459af93b16694ac841b80d7fbc4d7c0b9743afb95b4a74f17", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617339533, "uuid": "cc97ef7b-432e-46b2-9599-4b3f5d77dc90", "comment": "Malware payload (Dridex)", "value": "b1673852530ff3f0e2d4cd75cb4c549803b96214", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617339533, "uuid": "39639361-d1f0-44fb-90b1-332e8a20d4bf", "comment": "Malware payload (Dridex)", "value": "7dc2c42c9c5f0ad86eab149c2536161addf5ab2ed75443627ca080f9b624a2e721bf410b99b9625d9edd516ec6daad4a", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617339533, "uuid": "c86300d1-8e09-4e11-bcf6-a8ca49fc0c71", "value": "2914BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617339533, "uuid": "99895121-afe8-4374-9357-d2dee902a090", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617339533, "uuid": "644f5524-64f4-4bc6-95b9-355d074b4073", "value": "3072:Ropj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:mpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617339533, "uuid": "db97e587-1f91-44e7-9b05-ff9d12bb1781", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617339533, "uuid": "71f24ca8-f565-4dc6-86d5-e53b6a86164b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617339533, "uuid": "dfce8193-ea45-4881-85ee-05c3d4e2488c", "value": "a0c84d325eebbb6459af93b16694ac841b80d7fbc4d7c0b9743afb95b4a74f17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727564dd-93d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617384340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384340, "uuid": "38de3f9d-9353-431a-acc6-b825336ff261", "comment": "Malware payload (IcedID)", "value": "d42f5e3bed5464703a1f02e4f7ac5474", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384340, "uuid": "db8792f1-4d70-4c70-b240-b0ff4677eb00", "comment": "Malware payload (IcedID)", "value": "a106526331fa7c1e6e2bb3de6a5f8d5a848f314c539ff3b505225c18f161dd40", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384340, "uuid": "860ff323-f2e8-4a7d-b987-e37d307f0b0b", "comment": "Malware payload (IcedID)", "value": "e26e6aab6e8c5bb826877400dafca62455118290", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384340, "uuid": "515979e7-c4c8-4fbd-8409-bf5f1718ca39", "comment": "Malware payload (IcedID)", "value": "70f9ba3d5875afbc41c5d5015a54659919b724c31115cc55e84c38a941bdcf0c0d810b48c17c91c405033c3391c21516", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384340, "uuid": "146873b0-cd73-48b6-accc-80c30e1e92c9", "value": "A6530A8947503C91C0FEBD34F3A69A58931EFB30AA8F47B794C46BBAC47B5409723619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384340, "uuid": "750a2919-ed8b-4940-a1c4-86654283593a", "value": "eb10ff98c4adb7472a591c82bd2ff673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384340, "uuid": "9bdd773e-08d9-4e7f-8a8a-35553436e9ce", "value": "1536:caCAzXz8T6rLXah8lI+Idu+B3XbuF6dRiF:n/gTkXayetu+BbuUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617384340, "uuid": "de61cc3a-90e5-4da3-9799-e91cb741a197", "value": 65568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617384340, "uuid": "cb46b497-ae15-4225-bed3-9ac120896cad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384340, "uuid": "ae01bd26-d820-4adf-8401-1c05e43182f7", "value": "d42f5e3bed5464703a1f02e4f7ac5474.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a362b6-93df-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617387162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387162, "uuid": "5ddac345-7134-480e-9ec7-edcf55474759", "comment": "Malware payload (Gozi)", "value": "520840140d7770639fd9d7c06a26977b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387162, "uuid": "9da60133-c918-42a0-8deb-2911cac5b94d", "comment": "Malware payload (Gozi)", "value": "a1600c28548734d79d07a4d91da7e7420da472636a0820764247601f9dd73d5d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387162, "uuid": "45f9dfb1-ff5d-4a6f-b9aa-ae8bf4e1b171", "comment": "Malware payload (Gozi)", "value": "3ab5046f42b287f22ad93a7f3d912e5c325b67ee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387162, "uuid": "d0223ccf-6d55-4f3a-83ec-623aed852e79", "comment": "Malware payload (Gozi)", "value": "bd76a8fc85ab5ecdbff867f26bcab158cd10a93b0ba8cd6d2bcae208d52d90bf2999e5a1174c146e4ea0aa8effa78665", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387162, "uuid": "bcc0c323-7b68-45d5-b1c2-ff8ff9cbb009", "value": "5FB3DF00B9DCC4C1D3EA99B049A4DE75350AEDA62834900733F37F6D7EF63A629AB544", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387162, "uuid": "cd9d1dce-51f4-4ac8-9761-b10835f032c6", "value": "811de8e945c2087a6e052096546cd842", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387162, "uuid": "7881ef97-1765-4dd7-8b37-682d48eec5ab", "value": "1536:DWKaY5Se9WnVI78XvnoxJasJvRHKmyGDvDk0Rt9Y56l5ZMpvV05o9OX5xPw8:DWa0eQnVI7qCqZGDvDk4wol5w0EU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617387162, "uuid": "bcf4084b-685c-4f55-b72e-6d82ed386400", "value": 114920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617387162, "uuid": "45ede053-9e2b-41b3-99de-c56e40738773", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387162, "uuid": "e4e5dc61-4948-4453-aced-bc534d68a798", "value": "520840140d7770639fd9d7c06a26977b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d348d9b-937d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617345140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345140, "uuid": "f7f8811a-0c77-4692-853c-cc352237d586", "comment": "Malware payload (AgentTesla)", "value": "5d628a5b99a82272b6e714b8420fd965", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345140, "uuid": "54e3437a-97b2-4e00-a896-3818bcb5ae6d", "comment": "Malware payload (AgentTesla)", "value": "a1b3231292a99e8386b1f209db7f5bad8ec94aa877bd87661dc0b1aa66664aab", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345140, "uuid": "fb3c2c37-aed6-4885-8372-4cf888b9cca3", "comment": "Malware payload (AgentTesla)", "value": "5e607f93d64428e3097ea787c8d3e46559da764c", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345140, "uuid": "2a54a0ca-51ad-4da5-8564-183dd08f51ee", "comment": "Malware payload (AgentTesla)", "value": "902ea003891501e8e912a489249a9e06028e79d0d6a45dca1c58a35f82a3c042dc982a9e6c08525d226388f7d2a33335", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345140, "uuid": "05d24207-e890-48c9-9206-56f91774268d", "value": "CEA4231C881D39A44EF1728E341E6F375D3533C6A269C6486082CBBEF965D2E7A8D271", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345140, "uuid": "b8cbb4ff-cf71-438a-9742-d243437cc311", "value": "12288:yYkcDUrW55Ik7WpFFpvBl8Cuq1yG653ydK1ASTA+Ou8wiKWJxgQ:yhcDtiFB7l1yG2CQiYAa8wiKWLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617345140, "uuid": "f5d7eb62-129c-491d-a154-921a99f5c7ab", "value": 465132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617345140, "uuid": "0cd13412-a6a9-40f2-a840-3b30dab8a7a9", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345140, "uuid": "d3779b7f-32ca-4a20-a0c2-8511b248c6b2", "value": "New Order Quotation.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1464698d-9393-11eb-abe1-42010a9c0039", "comment": "Malware payload (LimeRAT)", "timestamp": 1617354547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354547, "uuid": "e12d4e36-2a83-4ac1-8bcf-ace01d17b8d7", "comment": "Malware payload (LimeRAT)", "value": "4358ed0c3918c0658a1b2bb1bc35462d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354547, "uuid": "dd65f079-f44e-4c0c-af55-0c471b702469", "comment": "Malware payload (LimeRAT)", "value": "a81addf8ad395ae36a617da9fb138337c17941475c1e3f3003d2571c8cb3b84e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354547, "uuid": "8af6e950-5dec-4a55-b488-fea00bd3b367", "comment": "Malware payload (LimeRAT)", "value": "728017a96e30fe41379ed36a1c9b3129751f3750", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354547, "uuid": "e4bd66d8-e78d-46e1-af72-d86431fad664", "comment": "Malware payload (LimeRAT)", "value": "0ca22cdce79810626d75384a35f0e293ab51ae5eec0d4a4bd4f44a26247e78aa9cded9842a48005ea384df04efac29b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354547, "uuid": "03a0cbd7-4f5d-4e83-a432-13f7089fe892", "value": "ECD26E1077E15345D2EC1AF60FB1A2650EB1DA47E93BFB3D0CC554921E6BED18A80BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354547, "uuid": "bb042ce3-55b5-4086-9708-430d9cd9cf64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354547, "uuid": "465b2588-0f89-47e1-bfe6-0e227332ca02", "value": "384:lB+Sbj6NKAB2t6zEAHrEqN3qDQCZnl7ZQvDKNrCeJE3WNgJvfURhj9KJKdv2Qroj:fpAa6zEwrpCpl7Ze45N2sRR9KHjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617354547, "uuid": "4f5274e3-9e46-4222-8ad7-e2cfb8f8c6aa", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617354547, "uuid": "29fb6750-b746-4632-9139-8d7c6607f86c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354547, "uuid": "c377ad5a-82cd-46c4-aff3-dd40ad509428", "value": "4358ED0C3918C0658A1B2BB1BC35462D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ebd975b-93d3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617382240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617382240, "uuid": "d4126712-be10-42ea-9efb-f1a37cade01c", "comment": "Malware payload (Dridex)", "value": "42f55556ffe88bc96610b877a7031022", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617382240, "uuid": "8999bccb-2c02-40d1-9f50-7e8917530edf", "comment": "Malware payload (Dridex)", "value": "a88a149d260143a508523141142d4feed77e82cc03a6522c99909e395c6f81f4", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617382240, "uuid": "65c8cbd7-8d7f-42c9-a92b-1a4c4c2b8694", "comment": "Malware payload (Dridex)", "value": "d0cd60cfd4231b7d0ae2c4656c34feb247cab319", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617382240, "uuid": "6c2d90f4-4c37-412d-8c64-e63323ff3250", "comment": "Malware payload (Dridex)", "value": "6e6f3e6c7e80192816c1d2a26811bcab6bcb3ff78d6751f1a1d2b3925fe3e0937cc8218238a9a5f3454e3d429a009026", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617382240, "uuid": "ebb942ec-83b9-4abb-89a6-f05a01515f84", "value": "2B14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617382240, "uuid": "91a4982f-5afd-4c34-9b04-aee1758425be", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617382240, "uuid": "04a49d4c-09a0-4615-9d73-8bbc13a5ddfd", "value": "3072:Dnopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:DopjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617382240, "uuid": "4f6b1c40-8ed6-4c42-832b-421740c06cc5", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617382240, "uuid": "d8c07aee-40e9-40bb-a145-8d33a590bad8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617382240, "uuid": "49a0014d-f3bb-4a65-a678-c0ba8e730c80", "value": "a88a149d260143a508523141142d4feed77e82cc03a6522c99909e395c6f81f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2516171-9397-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617356637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356637, "uuid": "02d57094-da15-4d1c-8b3f-8d2f9ba3be4f", "comment": "Malware payload (Dridex)", "value": "ee4503b9c43deffe39f38b8c8ae8df36", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356637, "uuid": "bf915604-d7e9-40e8-be8e-8f2d67d2e4f2", "comment": "Malware payload (Dridex)", "value": "a8d865856addb1b4662f6244fc834b57b5a30c0196e13e6f9ddd9981d641cf89", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356637, "uuid": "ba42cf63-bff9-4a52-a31b-ea206a5f69a6", "comment": "Malware payload (Dridex)", "value": "cadc995f330fb646dd96958919d3fd21cb5baf88", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356637, "uuid": "e5ef741c-097d-4998-bc22-5aef7d3ca718", "comment": "Malware payload (Dridex)", "value": "d728e02db42ed1eb0b6d0c03de6eb1976f8da381662df30c7ea80559661afdc007fe40f13f84b1b6d831b0b80e10308c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356637, "uuid": "8768c786-b464-4381-9820-ebe448a7f5d5", "value": "99248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356637, "uuid": "704d590d-8edf-4aca-8617-7cd1e2f7ca6f", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356637, "uuid": "5d6a7f2e-9260-4622-af56-dc7cab44a8ec", "value": "3072:N6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:NoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617356637, "uuid": "c4087615-fab0-48a1-90f6-62499ec359fa", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617356637, "uuid": "5b6ddee0-28fa-4b61-b561-5348195af0a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356637, "uuid": "0980644a-0164-4673-8667-000d2eb462ac", "value": "a8d865856addb1b4662f6244fc834b57b5a30c0196e13e6f9ddd9981d641cf89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f716edc-9393-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617354619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354619, "uuid": "412a0723-a069-4dbd-ad3a-3c7bebf5906f", "comment": "Malware payload (Dridex)", "value": "6097d5736ff46f44eab50ade8950fbf2", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354619, "uuid": "e1c20ab7-3652-43f2-9078-827e42b80aa3", "comment": "Malware payload (Dridex)", "value": "a963e4c8a01e19a55a2a617fa026249bcf9d7710fe752babf3aea81823a77821", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354619, "uuid": "0e1efec2-5aed-403d-a88b-06ce7334ad36", "comment": "Malware payload (Dridex)", "value": "e54653fa2bc93e05c65c014497570cdddeea18e9", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354619, "uuid": "91c00c3d-ba3d-4a39-9bef-13e2c9958a8c", "comment": "Malware payload (Dridex)", "value": "178fb054c8e4647472d1c4b1f57391554e594d676852f4344b07cd29bf6bac628a162e8a6163c36f12a5fa789e67bce6", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354619, "uuid": "7f5973e4-6467-4d24-908e-05ac0056db4e", "value": "EE14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354619, "uuid": "2ab37f51-9376-4eb1-9452-d70bb44ac90c", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354619, "uuid": "2b722c1e-94be-4a2a-8138-2460b7eae568", "value": "3072:Copj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:VpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617354619, "uuid": "8154106d-c4ad-4912-85d8-62b14a932890", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617354619, "uuid": "bd754590-6aca-49e0-899a-c6e6336be78a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354619, "uuid": "06ed844e-5b66-4abb-b336-489debb5036c", "value": "a963e4c8a01e19a55a2a617fa026249bcf9d7710fe752babf3aea81823a77821", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eaad65b-93de-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617386911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386911, "uuid": "6662eda6-306f-47d9-9823-9a1561ece1aa", "comment": "Malware payload (Dridex)", "value": "8c47d37e1e42f902d38f418f28e79a80", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386911, "uuid": "4527960b-cd4c-4cb5-8b5f-de376baac277", "comment": "Malware payload (Dridex)", "value": "a99011c63838f61c9e35c767122b103049e8ea8efbdf39f8bf6c522888784583", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386911, "uuid": "8b8a7d00-3916-46b2-bd6e-a9ebfad49d6d", "comment": "Malware payload (Dridex)", "value": "933543e6a4060ada8ac30fd77be7e1f8b60bc56b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386911, "uuid": "27b1771a-38bc-4e97-bb23-2a8b80dd9e96", "comment": "Malware payload (Dridex)", "value": "a9858ce1576921e92654eb9454537c8624142498f429bfc6032b4a07d2f078dfdfe610e727f9dea24da6f6ceef293b63", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386911, "uuid": "34d325dc-3712-4334-9da5-aa69a1be1ab4", "value": "01248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386911, "uuid": "52605634-8c00-45ed-8431-267a555fdd6c", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386911, "uuid": "120023b0-69ba-4e36-bd38-598db2f6eceb", "value": "3072:L6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:LoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386911, "uuid": "1b495bad-d926-4380-8dad-82571ef64d10", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386911, "uuid": "24bd43ac-4325-417b-a496-bdafd952d1b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386911, "uuid": "2ffdcb39-a6be-48e8-89a3-976c6ce05cc2", "value": "8c47d37e1e42f902d38f418f28e79a80.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d72fab35-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1617386657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386657, "uuid": "aabe518f-4a29-4c27-aea1-968249bfbf25", "comment": "Malware payload (AZORult)", "value": "6eb01a2cc87530cab446998b63a9ee3f", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386657, "uuid": "03b48b9c-b5c7-4582-bd6b-ecf335b6b7c8", "comment": "Malware payload (AZORult)", "value": "aa07c007efcdbe618fe879d04070276260e9815f9932d02b759183cdb0c2c188", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386657, "uuid": "d6d37052-27a5-4692-ab9d-a8bead047f3b", "comment": "Malware payload (AZORult)", "value": "ce79436a6a043638c6da3309543a9e8b271795ee", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386657, "uuid": "fba49e20-001e-40c5-affe-f316ba1f91d1", "comment": "Malware payload (AZORult)", "value": "1f5cbddb1ef9a756f67439097d58a083cd8d86f951f595d00d83d23cdb73d5b4f6bc78b37b25900fecade06c18b1e7d5", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386657, "uuid": "5a899dc3-0e61-40f5-86f7-1baefb8d5174", "value": "74E312CA32169AEB39C9E3482E91455FF426788D4B7C48A1E47C11794F816AD8FE3C0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386657, "uuid": "7dbdd020-4a06-436a-88af-36c10fd73875", "value": "3072:Q8nQzQZWE2hYqRlnWtDmvbVyWIbSBWzBTGv7qVOud19vzRfB98PnHeGU6m:SqWE2KslnWtDmD8AWztG0RZnQnHHUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386657, "uuid": "7749e090-90b7-4cfd-9358-a137d91c18ef", "value": 145590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386657, "uuid": "af395ba1-50eb-4e7c-acf9-028d002ba2a2", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386657, "uuid": "2746bdd2-8de9-40de-a528-c6f1bf20b01d", "value": "TRF-999014-07.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65cf4463-937c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617344805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617344805, "uuid": "e0e8f4d5-8f85-4eaa-b5c2-551a3b39004c", "comment": "Malware payload (Loki)", "value": "5c1733a6613531f9a71f02a2eceab825", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617344805, "uuid": "c28487a4-1dc9-4724-b3a7-9fab8184e82f", "comment": "Malware payload (Loki)", "value": "aa3c42d979c9f620a3e8913869981722b665030b5b29a8af7c5259f3bbe0f410", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617344805, "uuid": "e52a6829-5dee-4ffb-a1d6-34622ff887e3", "comment": "Malware payload (Loki)", "value": "9e27e626dea5ed2486f9a72950fb0f9eee102114", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617344805, "uuid": "3d6ce0b2-0fdc-45eb-941a-1cedd4ac4938", "comment": "Malware payload (Loki)", "value": "18eec62cab1f77c903344d5290c7c86b4d41aafd4b0f4e4aa5d2fb48244d9fba6abb3ea1b2e51af922ad76d45dd8c525", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617344805, "uuid": "f11cfcac-c36c-46c5-83b5-3c491f0bff5b", "value": "031573B444C908A5E2DBC4513EEEFD7011B7F4D7CED65D6403BCD6320A69BA62E83A08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617344805, "uuid": "88449a91-0c72-4b93-ba43-f001e2590231", "value": "12288:kBd5DxL57JwK4Cy5Dxv3MPU5Df5DxY5DB5Dxp5DS:6Dn7JV4C8DTDxDYDzDNDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617344805, "uuid": "9df14a1d-7b6c-467e-b3b3-b0911e80d0fc", "value": 894058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617344805, "uuid": "6715c59f-fee5-45cd-8201-be6b87f062c4", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617344805, "uuid": "a3bbadc2-47b3-42aa-9bbf-1fd708aee650", "value": "Price Inquiry.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b950d551-93de-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617387036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387036, "uuid": "7eb6ba77-9b39-4924-8bb6-e7666bfb8f2f", "comment": "Malware payload (IcedID)", "value": "a20d0a352efb678df628de3ddb9576b6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387036, "uuid": "825b7ced-5e8e-4e0d-a452-e6b3bb12cfb1", "comment": "Malware payload (IcedID)", "value": "aabc5e925d6ec78177b08d44b369eca6b17e492d97f0c5c4da2505965ed9f595", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387036, "uuid": "07923c30-81da-4cf9-a994-999d52041799", "comment": "Malware payload (IcedID)", "value": "faf91489bcf19a3b137c1ebafa8107c39f6f8e49", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387036, "uuid": "2eda8872-3613-4c6d-afc2-7fe69cc7311e", "comment": "Malware payload (IcedID)", "value": "9c1037c17c5d12cf4ee656a343aa5231b4b1e1fe5ea4f0a930068d6efa5d5410d24fe14b85634e6d1516746ee6e3071a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387036, "uuid": "81a6141a-4edd-486e-8c30-1833c625add5", "value": "FD530A8947503C91C0FEBD34F3A69A58931EFB30AA8F47B794C46BBAC47B5409723619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387036, "uuid": "f3aeaedd-2563-4dd0-9736-5ea7a16d9a73", "value": "eb10ff98c4adb7472a591c82bd2ff673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387036, "uuid": "553c9e3d-2a4f-4155-87aa-d878e63044e0", "value": "1536:caCAzXz8T6rLXah8lI+Idu+B3XbuF6dRiF:n/gTkXayetu+BbuUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617387036, "uuid": "9be1f4a8-5a21-4107-b6c0-2209754787b7", "value": 65568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617387036, "uuid": "e89641a2-9b4e-447e-9b01-669bf735c24a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387036, "uuid": "0f465046-5d9e-4720-85bd-3d6928791036", "value": "a20d0a352efb678df628de3ddb9576b6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b794421-93da-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617385241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617385241, "uuid": "a624a2c5-1ba7-4a15-89b2-3993f463a66c", "comment": "Malware payload (IcedID)", "value": "0303997066bd585d83fa4c87d829d758", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617385241, "uuid": "b05b2974-bf3f-4e8d-a60b-fa35517d04ba", "comment": "Malware payload (IcedID)", "value": "aacdf284665bca76811d1afbd267c93a39f06aa93c73f2d0cfb1679bd5b076ea", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617385241, "uuid": "e7d95471-2397-49ea-a2cb-ac8254c8b289", "comment": "Malware payload (IcedID)", "value": "0efdbdd268e4083a03a24f4b07d5a068b5e2e877", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617385241, "uuid": "e4ef3093-6151-4dc1-870f-1af00e3abf56", "comment": "Malware payload (IcedID)", "value": "a201415b80f793eb63eea69bf6a818ab56b111c37ad45ddd3ed962cb057d9e8d9e8460b96e1a5b36e61ac453f6c4efc8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617385241, "uuid": "f457ceb7-5d8b-4fde-93c1-50cc8a24b875", "value": "F4530A8947503C91C0FEBD34F3A69A58931EFB30AA8F47B794C46BBAC47B5409723619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617385241, "uuid": "d6d4d20c-95ec-4170-b182-ab187d6e81ed", "value": "eb10ff98c4adb7472a591c82bd2ff673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617385241, "uuid": "a01ed607-abdd-4c4f-b092-1f8a0d5ec821", "value": "1536:caCAzXz8T6rLXah8lI+Idu+B3XbuF6dRiF:n/gTkXayetu+BbuUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617385241, "uuid": "c1059c33-c125-4288-99ff-48cbd84d8ebd", "value": 65568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617385241, "uuid": "624723c0-7fa5-49f2-8880-7e08a2c95229", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617385241, "uuid": "fbd76243-f89d-4075-af3c-f9e31a21fcdc", "value": "aacdf284665bca76811d1afbd267c93a39f06aa93c73f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f63e258-93e2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617388603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388603, "uuid": "1b8179f9-a59f-4b93-b7da-0911093bfdf8", "comment": "Malware payload (Formbook)", "value": "b7004f273feb915836085431e37ac3d1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388603, "uuid": "b24566bb-9b7d-4b59-9be6-7032b644d01c", "comment": "Malware payload (Formbook)", "value": "ab95bc3c40647b2b700cdb9aba76b6de220fd528fd194e6071c1747df6cb78ce", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388603, "uuid": "7acbfa51-7473-4aab-b458-9124bf96be56", "comment": "Malware payload (Formbook)", "value": "47ec34fc43a104b329bbab16cb95a9059a400482", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388603, "uuid": "2e489cce-3186-49ee-bb27-be4d0e7ac324", "comment": "Malware payload (Formbook)", "value": "7ae51d8cd36914f788e1cf82fef4441da00364a89272f755bb4fcdcb54250d2f847655d7ded93ada29c8739001370496", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388603, "uuid": "915e8c27-5a53-4b51-9296-bf34f53e9f95", "value": "9124125906F0015BC86F9B70A777D6A2F77AD600253B42B737E02F2B661164ABD0A31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388603, "uuid": "31fe7fa2-d941-45c4-81e9-b0ae559091e5", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388603, "uuid": "34b09496-9a47-410d-a61b-7fae2520f9cc", "value": "3072:vTs3BxJNmJBD8bH8qwEiVpx6eoNIjDa8xwF/QDFyBoEPasdC54V+J/STqMmJbRql:vAPFaP6ZGva8CxQxyBPasNYSTVeVWj6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617388603, "uuid": "0680c94c-b9ee-4da1-80e3-56921ceea258", "value": 216953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617388603, "uuid": "cd4b7485-8b26-4094-be46-e22d333904d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388603, "uuid": "9948aa81-7574-4558-8094-e7ea4a6c2710", "value": "Payment_03262021_jpg.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064ee3d0-93de-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617386736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386736, "uuid": "0a2ab7b9-c359-4d46-8bb3-15480ab877fb", "comment": "Malware payload (IcedID)", "value": "462437c734efa779a7fd2d445d3a9ead", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386736, "uuid": "e5027376-16af-459e-8688-419c266f4a23", "comment": "Malware payload (IcedID)", "value": "ac1639e7343fa438e996763b0082e59cb0e3f9d0780ad93dbea8fe40d85f89fe", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386736, "uuid": "2ec5edd7-d83c-4cae-bda5-9a65b477a9b0", "comment": "Malware payload (IcedID)", "value": "959644ae33f6cb05aaf6be6a42cf9700f5e140f8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386736, "uuid": "590896a7-d035-4a6b-8d33-eec1a8fb466e", "comment": "Malware payload (IcedID)", "value": "159920ca169da0da15523d518759ffcc1986793cd7c7ec7b8fe3c06a71520ea060a0a77648a14e5a7de4b2f1c3b1c82e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386736, "uuid": "7af4e539-51e7-4071-bcb9-01e92417958e", "value": "4D530A8947503C91C0FEBD34F3A69A58931EFB30AA8F47B794C46BBAC47B5409723619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386736, "uuid": "0659296b-a9b7-4ab8-bb9e-c3eec8677fb1", "value": "eb10ff98c4adb7472a591c82bd2ff673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386736, "uuid": "3076abc7-9a0e-42f6-8040-a64ad0bc42ce", "value": "1536:caCAzXz8T6rLXah8lI+Idu+B3XbuF6dRiF:n/gTkXayetu+BbuUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386736, "uuid": "b2932fd6-cefc-40fe-9325-843cfe682734", "value": 65568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386736, "uuid": "2ea5eee6-8130-4740-a84d-ec3da0d47724", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386736, "uuid": "cc005d0f-3273-4e07-8884-285663f3e7a8", "value": "ac1639e7343fa438e996763b0082e59cb0e3f9d0780ad.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31737098-937d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617345147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345147, "uuid": "811add87-a8dc-4ce7-bfad-cccaaf260224", "comment": "Malware payload (AgentTesla)", "value": "1974cc11aefb926bb2d662c6b3cf9fae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345147, "uuid": "b56d9a50-5443-4ed4-84a5-d43b92c8cd3c", "comment": "Malware payload (AgentTesla)", "value": "acf30aabe0138a2fd83f455da4a9a3cb10c374e33b2ed7d4570a799f58e91028", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345147, "uuid": "e6304d5c-7f75-401b-8895-f5729bd3db05", "comment": "Malware payload (AgentTesla)", "value": "11df7fc2f0c205a4d2ec23b85f41696759a46155", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345147, "uuid": "6a3ecf58-8ab4-42f6-ae70-e64d788dfb98", "comment": "Malware payload (AgentTesla)", "value": "687205fdea20e8db837ed4ebccc617f13fad2d1cf42e74a5e56d08b5f2fe7348ea19f9ca69b71e6d1a30937d40885705", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345147, "uuid": "e892e41b-f957-4412-8fad-2c5cedeccc2f", "value": "63C4DF24E79C9A5DE17E53FB507032343FFDA195A622FE8DEED120EC25623418162B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345147, "uuid": "5695a06e-f9a6-42b2-8676-814997c8e070", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345147, "uuid": "8e33201d-d552-4488-b0f4-4d49a441bf51", "value": "12288:E4O2PUNKon9wh7fB9ulprbQcfBxgB8U/Z55ymOcxXg+:EF2jon9ofBKrbQLB8wwctg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617345147, "uuid": "9cb1779d-337e-4ed1-abea-2c5295fcb19f", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617345147, "uuid": "0337de97-f3a2-45a0-97b1-75c079efcc7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345147, "uuid": "856927b3-7d3a-48cc-8f77-efbca49f4344", "value": "New Order Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9055943a-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617386538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386538, "uuid": "4ac548bc-5c9c-4b05-ba5e-03df1179b80d", "comment": "Malware payload (Dridex)", "value": "b9983a83761a6ad6e0750e2fb297e581", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386538, "uuid": "34224e3b-6e1d-4c7d-b0d5-91a1f39856ca", "comment": "Malware payload (Dridex)", "value": "ad1466bffb69c97dba06d5106929c4ab251955462480f7901c21fb4709447e31", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386538, "uuid": "527769fd-86cb-43c1-aa83-947fea3783c7", "comment": "Malware payload (Dridex)", "value": "4d5253d2501f947aaf12dd922ca958d2cc09a274", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386538, "uuid": "4a2207b2-ed77-4505-83de-02c5a4bd72cf", "comment": "Malware payload (Dridex)", "value": "60df0e00c3a218b9b3fde250c57ac43791d8f9b30476ca8e8e1a2e5174e6571a4376bd05cecccecbfababdb0a6c67655", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386538, "uuid": "1d41b335-ca7c-4f4b-892a-c8068ed938c7", "value": "AB93B0E9C712F4E2E6D8CC7CF106B452CD2292635F07F20B5256935F0A179AA5C2E29F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386538, "uuid": "c2148353-f755-4c1a-bb9c-a88c99d086c5", "value": "1536:ub/ndoJz+kgpei9EM5fybX8dz+HAITWPtsmLMWzMNFOfhOJYS6xybsD9fe2hawZ+:ubpJ5fybX8dz+HzT0s+MWzYoUJixzWMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386538, "uuid": "5be9cd9f-486e-4748-ba40-b836f8cf4ee6", "value": 95672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386538, "uuid": "86283200-a03d-4336-aa3e-1a8edab5c3a9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386538, "uuid": "6de76c7f-0023-446b-9205-8caba6b443c8", "value": "documents-1760163871.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc69385-93e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617388252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388252, "uuid": "f3b85016-1266-430e-b685-409ff6a8b04a", "comment": "Malware payload (Gozi)", "value": "5fcbd89e8d982c6cb93591e564174859", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388252, "uuid": "d685b521-b71b-4a7d-aeb0-3d54eb5aecdf", "comment": "Malware payload (Gozi)", "value": "adc53ae280515df1f79e4c45b0bff1fe484a6994beca972b2a88107c42e21f54", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388252, "uuid": "16779cd1-80a6-4742-9594-0d08e8f898d8", "comment": "Malware payload (Gozi)", "value": "c90d97d11c2b8e5424e07b57b2333e1a5d057f28", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388252, "uuid": "566a49e6-cc04-4d5a-8807-9a54008bc19a", "comment": "Malware payload (Gozi)", "value": "a0592c019431c73cac21f3cc224a939126cfe26cf426d64c22cc9cd4a7d1f68f65ad74e4403b88a7d23bbf29a49154a0", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388252, "uuid": "af9defd4-9bfe-4d1b-9f95-b612f09b551e", "value": "8EB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388252, "uuid": "21318c93-2402-421b-b167-0074c82755c1", "value": "3072:A2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:AqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617388252, "uuid": "b068c6b4-c197-4e92-b9be-2987dfa09eaa", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617388252, "uuid": "84115919-2e74-4ad3-8fd5-fc6124059661", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388252, "uuid": "91abd080-42e3-4e8e-83bf-87e7b4da71b6", "value": "document-4077682.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d437da1-93f5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617396653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617396653, "uuid": "6ea8802d-9db6-470e-b110-210586dcac16", "comment": "Malware payload (Dridex)", "value": "fc32526d41163085602a0b8b40d82550", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617396653, "uuid": "e0210446-74dc-44bd-b350-e89432c10f91", "comment": "Malware payload (Dridex)", "value": "ae5816b2f3008df6da54da5131820b012a4e3a96ce97ff5913190aa267fe33da", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617396653, "uuid": "56dc45d4-ced6-4e34-a551-d5ac089a902a", "comment": "Malware payload (Dridex)", "value": "355a6fca425b5dadc035dc63b90b0ce2a67950f7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617396653, "uuid": "cd964bac-6f69-4e14-8f59-318ebb368856", "comment": "Malware payload (Dridex)", "value": "b86b81b1753bbf132f6659b92e474d0d18e7fb8c8fc3466b5114699d234ac2c2c65383b7f2f1081bcbc0d15ed99e72d6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617396653, "uuid": "ef35ef1e-6df1-4f74-a84b-b6f9dcba0223", "value": "5A248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617396653, "uuid": "b153b773-3a91-4607-abc6-31c79f09d3b2", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617396653, "uuid": "bfc33aef-c278-4fba-b564-062457ef38ab", "value": "3072:A6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:AoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617396653, "uuid": "23a0433b-3639-4ffc-81ca-4d451aca8a16", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617396653, "uuid": "ed38e5d2-26cd-4e5e-92fe-4aabdcefdfa9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617396653, "uuid": "bb416d88-fb28-46d4-a676-63219348723a", "value": "ae5816b2f3008df6da54da5131820b012a4e3a96ce97ff5913190aa267fe33da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac6b326-937a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617343901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617343901, "uuid": "2ff0d89c-4a55-4dc3-8635-f4bd99beb925", "comment": "Malware payload (Dridex)", "value": "72a13834a14b163442c8b7d19a0d2c70", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617343901, "uuid": "1f20a7c0-a1e5-4d95-9255-022a82904778", "comment": "Malware payload (Dridex)", "value": "ae77704b6961d02a104b85dab0a20f2a378dfcd2e00db2df8ecdd6244967c3ac", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617343901, "uuid": "19670939-86ae-4c2a-9d4d-1286a03879da", "comment": "Malware payload (Dridex)", "value": "bc9a59127b439ec518895d9cbb4bd00fd94a9ecf", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617343901, "uuid": "a7d4681d-c1ac-425c-8d59-01d5fa2f6f32", "comment": "Malware payload (Dridex)", "value": "aa855a2557dce58a07663fb3031f9d74bf56de0682c6b49c1a3ab3c7439c5a1526a3aae4677fe626224e463ae2336ac8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617343901, "uuid": "53aeaef2-20b7-4450-b63b-87bf68789395", "value": "1C14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617343901, "uuid": "b29a661d-483b-42a9-bbc5-02a4386201b4", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617343901, "uuid": "df61ac1d-05b1-46ca-9b53-ab6394ed3167", "value": "3072:/1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:di78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617343901, "uuid": "62aaf67c-1e35-402b-85c1-884083b7829f", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617343901, "uuid": "c9081392-b39a-432c-b4fd-91044a374f58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617343901, "uuid": "ab39f91f-f016-448a-a8c2-366afffca657", "value": "ae77704b6961d02a104b85dab0a20f2a378dfcd2e00db2df8ecdd6244967c3ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed140e9-93f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617394991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617394991, "uuid": "031635cc-8c43-4e19-ad96-53b17c011d09", "comment": "Malware payload (SnakeKeylogger)", "value": "6c2dfaf91244df2c31267b80d30f7486", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617394991, "uuid": "bcf51736-1bad-49d2-9406-8f415f06a58f", "comment": "Malware payload (SnakeKeylogger)", "value": "af324063df6acfa431a49d84e59f21c3707c6c0394bab59248699024faf815e8", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617394991, "uuid": "a07b98da-9934-4281-9cda-d6d6f813fad7", "comment": "Malware payload (SnakeKeylogger)", "value": "72b43b6e52725a5793eb4a09404be3b13fafcebe", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617394991, "uuid": "0d39e957-95d9-457b-9b67-63fec57483f0", "comment": "Malware payload (SnakeKeylogger)", "value": "55e05278518b77ab916d2d34d1976d41ae29a5057266c75773ec48b347651aed457ac69f07e281b92024614a3c5e3f71", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617394991, "uuid": "98bb714a-7d5a-4025-869b-f20bfc00e7ee", "value": "5525BF1A3F24558CC0AA27356464D10C6FE67CA9A693C28B3EED37DB6473F130BB4652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617394991, "uuid": "fe2c96cd-ddba-4b0b-8b5b-bbba2b48d90b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617394991, "uuid": "82d877ee-62f7-4043-b680-018a7a31f560", "value": "12288:Rozyg+L2mvSdhfc2R9Ybs7EgSIarzoP+VjMQZAT:RozyzvSI8SbcQXv9MjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617394991, "uuid": "c155ab28-269b-45ae-8aaf-9c375bdd02f7", "value": 979456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617394991, "uuid": "9a471185-ccc2-4774-9445-ff9f65f6b89f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617394991, "uuid": "bbf85d93-beb3-4ed6-92cd-023300962d56", "value": "PURCHASE ORDER - E3007921.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d66bcb-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617386685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386685, "uuid": "7d82ad63-c677-4c68-8a3f-ce64917a85e5", "comment": "Malware payload (RedLineStealer)", "value": "420e1716f5af4b517658a4727c745b0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386685, "uuid": "c00ebe70-5472-41e7-93a0-369212008f2b", "comment": "Malware payload (RedLineStealer)", "value": "b09976a43d5913010490f4f7334a2f8fcc7ebd48143328fab73872ae339e783a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386685, "uuid": "9419dd47-5e5d-45b9-8d84-779bc614ec30", "comment": "Malware payload (RedLineStealer)", "value": "6c91909ef1d8b17d6f931fcbcffd67652627b552", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386685, "uuid": "ea263848-7554-41c2-9f00-10e47179365b", "comment": "Malware payload (RedLineStealer)", "value": "ef38b1d082f445d65a576703b0ea9f4650bde634f42cfddb203805e77818bbec98c14008fd312afa3b5ed3df07f750d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386685, "uuid": "5fbe7fac-e4ee-4b75-b33c-c880005b9461", "value": "6AB40121B1D1C273C4B7147184E2CB7A9AB97171077A90EBB6DC17AA6F113E4A7342CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386685, "uuid": "0942aee0-c250-4594-bfd1-33d8eec039f3", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386685, "uuid": "b4103730-a07a-43e4-8f34-ddeb91b69122", "value": "12288:Mh1Lk70TnvjcGKGp4JFtdYdB9Xt6drjnLrOJZ8U:4k70Trclv7YhXoZngZ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386685, "uuid": "4c5bc7de-a5af-4419-8315-bbf805ffb590", "value": 513024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386685, "uuid": "27a0891a-09d8-4da5-9678-095cb921950e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386685, "uuid": "be827428-0e21-4ce7-ab2d-5607968e753e", "value": "user10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab1d38a5-937e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617345781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345781, "uuid": "e95053ff-9800-467b-a9fc-3fe66fc83330", "comment": "Malware payload", "value": "a03e4a9d951dbf844686e4c1173a81b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345781, "uuid": "d2e821b6-f21b-4803-bbf4-943760b480b8", "comment": "Malware payload", "value": "b16486907e511c6ad3c363ce2ddcd16c650ae8df11532e7d394ecd00ab565a39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345781, "uuid": "4262eb59-6801-468a-9046-ae1a24ef88dc", "comment": "Malware payload", "value": "4e97c35f139cbb9214e6d3e2514380221cbe55a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345781, "uuid": "7fb93a84-7afc-44e4-9a1a-1018db326059", "comment": "Malware payload", "value": "fe06db9032158ab2a4f5eb89038051ac8f426c5f2455aa194a08088cfde9c183894564e436bd3277693f4149f4022f8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345781, "uuid": "a608c793-04f3-4df7-a6f8-2202280027c5", "value": "5E252CA0DDEF10F0EA079870955BA23F5225630A5F38DDCBC6841E82E677EF1153396A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345781, "uuid": "e149a669-e122-49c3-9b1d-83e3ef987933", "value": "24576:vBF672l6i2Ncb2ygupgrnACAmZ/NwFC31G3AcMxA7zqfKQK3M:r56uL3pgrCEdTKHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617345781, "uuid": "e71177d5-ecd5-49e7-8f6f-761d7141bf7d", "value": 1041433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617345781, "uuid": "0066fd41-a0ed-4257-9510-2cbfa12586ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345781, "uuid": "281efff5-3940-4e8b-ba6c-59c5d5f0bc17", "value": "a03e4a9d951dbf844686e4c1173a81b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d28607d-940d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617407068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617407068, "uuid": "9d58e721-31b0-4023-98fe-b44c447a230b", "comment": "Malware payload (Dridex)", "value": "61d4aec002880d61f0042d062084e217", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617407068, "uuid": "50946ca4-14be-48af-83e5-26f9b7876c12", "comment": "Malware payload (Dridex)", "value": "b17c4c86c2db07fe1acafe3aaee99ce30ece7f5d47f4d44f8bde46232a8233e7", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617407068, "uuid": "94c212f0-298f-4702-96e6-c628e0d0ca62", "comment": "Malware payload (Dridex)", "value": "9fcc7c5702af0bc603baa20d0d530f5e05604e73", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617407068, "uuid": "b625043a-90fc-48fe-8530-43db295faa45", "comment": "Malware payload (Dridex)", "value": "68df9bb2eb70e9df776f9f1678bbbec0cb7a10c51504c0ff5b514847ff2d659dbba4f118b968311a41c22d48a483170d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617407068, "uuid": "e05cc059-d486-4a5d-b13c-674a19f0fbcd", "value": "2B14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617407068, "uuid": "a3ca99fd-3b5e-40b0-a285-fef87732d2cb", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617407068, "uuid": "021fa209-9122-49a3-aebb-35454d9a158e", "value": "3072:n1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:1i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617407068, "uuid": "dc7a0e34-77bf-40f4-ac40-78e45595678f", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617407068, "uuid": "5805d767-2a5e-4670-a38e-34e71474729b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617407068, "uuid": "d5ff4dc4-e339-4cda-a598-ac65abbdb360", "value": "b17c4c86c2db07fe1acafe3aaee99ce30ece7f5d47f4d44f8bde46232a8233e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95f235d-93a5-11eb-abe1-42010a9c0039", "comment": "Malware payload (CobaltStrike)", "timestamp": 1617362609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362609, "uuid": "b6a84e17-df70-4cb7-b3ec-3e12f0695343", "comment": "Malware payload (CobaltStrike)", "value": "2c6ff9a336df1f2b620769c91fd7b0f6", "object_relation": "md5", "Tag": [ { "name": "151.236.14.53", "colour": "#BB80BF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362609, "uuid": "2e196f6c-eb1f-4ff6-b44d-564fd58a29cd", "comment": "Malware payload (CobaltStrike)", "value": "b1e6a236f66273f314961b8b6731fe76df76d0a900b3561dcf85447ef73041d4", "object_relation": "sha256", "Tag": [ { "name": "151.236.14.53", "colour": "#BB80BF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362609, "uuid": "78b887fa-f4cd-427e-b3d1-2ef093bf0ad1", "comment": "Malware payload (CobaltStrike)", "value": "fcb6ced0887e755a28bbf78d10077895ebcf213e", "object_relation": "sha1", "Tag": [ { "name": "151.236.14.53", "colour": "#BB80BF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362609, "uuid": "62f898ad-f619-43d7-877c-38d216501b1b", "comment": "Malware payload (CobaltStrike)", "value": "26df16f304f7b008ef9c0e307b16a491dd5610339bb096ee2727ae18315792b740da8dc65718bd64f232239bc966c652", "object_relation": "sha3-384", "Tag": [ { "name": "151.236.14.53", "colour": "#BB80BF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362609, "uuid": "b618d7ab-1262-4a3f-8695-49e8babb1649", "value": "E8448E4074C1C872D8BE16300539DBB6467DFD214B78C9EBA7D91E7E4F312C19632AAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362609, "uuid": "d8101b7c-4b0d-417e-b8db-9f5680f3aac7", "value": "bf159b76bae19ceeadd5c187bca20577", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362609, "uuid": "279757df-185b-4531-bff3-393fd84d8b85", "value": "6144:vSgMQTEIMv+87yiLipOVji8V6MVJqun9VobN4vAOzqgj2m:7MQTEDv+8LPG8Dqun9Vo5eEi2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617362609, "uuid": "8470c2ba-384b-4eb5-902c-31e6574722fd", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617362609, "uuid": "6a6854af-d2d5-491d-9722-051fe99f7e4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362609, "uuid": "a8899102-57d0-4a68-8cad-302901603f6b", "value": "b1e6a236f66273f314961b8b6731fe76df76d0a900b3561dcf85447ef73041d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50eb9519-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617386431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386431, "uuid": "36538a4f-02b1-4de7-b09c-8bacbdf54af3", "comment": "Malware payload (IcedID)", "value": "7c6f6cdec5354dcb10dcdcdf8b733879", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386431, "uuid": "5044942d-f39a-4abd-9b0a-9097eac93f0c", "comment": "Malware payload (IcedID)", "value": "b27aa1008f63efdd3e643e330d186ad53b2de1391dc0468f6a4cde52feba3545", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386431, "uuid": "20bac738-f2de-4ded-b8ef-ad6b8226a777", "comment": "Malware payload (IcedID)", "value": "6f61cbdbc86d7813a57b263c3ae32162dd9f1abb", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386431, "uuid": "de909f22-1892-4328-aad5-37dbfbf817af", "comment": "Malware payload (IcedID)", "value": "de5c15c5724589671fe68ace4bc73854a7e7f3facf51d88b881606332a08438376b530e6da1b7bd17bab91f4f75a63bb", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386431, "uuid": "7fadd50b-f3f1-4cc9-be47-6da8c7c1ff46", "value": "C204123CD0274C58C2E5447BD858C246AC6A2427ADF8A5ED668CB994EA137F30F7FB44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386431, "uuid": "b475b61e-307c-44f3-8094-385897561f17", "value": "3072:tXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGDKJj:xE5SDvbXAyHbVt15wTQD0KJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386431, "uuid": "b3658ec8-e7b3-4e44-914b-86be060eeb2b", "value": 176993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386431, "uuid": "f89626e7-b006-4f6b-9872-805547476bfb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386431, "uuid": "60a99839-6d1a-4ca2-9c6a-2c26851f9d6a", "value": "91237434194-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ec9086-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617386628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386628, "uuid": "e638e3d9-3ac0-4b40-86e9-f9b6c97ed013", "comment": "Malware payload (AgentTesla)", "value": "6ab75dd0b962959b5b4c0e499763d271", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386628, "uuid": "bcd61c40-d5f2-4b50-9e71-05d812cec6a9", "comment": "Malware payload (AgentTesla)", "value": "b27e46d008381b389570b34b3711b0676b358e37ee95e7ce7ca8d7d2f2389e18", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386628, "uuid": "1492e0b0-97b6-4d25-9319-c18fde9258c0", "comment": "Malware payload (AgentTesla)", "value": "a72d82cbe0d5cbcd882b7c60a1e0c117a1c2b6a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386628, "uuid": "41506375-f879-4cbb-a080-43feebca80fb", "comment": "Malware payload (AgentTesla)", "value": "6dd7c257f510691b2b68b97293697166f4092398fd65174066bea45903ba4b2a74d1a9fc27cd0cdba05b34f9ad26e36e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386628, "uuid": "a0bcc159-80e3-41ab-a54a-22aa8fb0e732", "value": "01F48B233743BBAEDD7843B61851450032A5AE36E76BC41DACA1335D1FBB7C147AD262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386628, "uuid": "08384526-aa85-4849-a367-4404d5b69bfb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386628, "uuid": "a1fede87-4adf-4ea5-a757-56f0304aacf6", "value": "12288:KA8Pd0Yk9OKIPCRtHT0BcZYc2d0J8/2qa7pDy1q0z:2Pd0YkgdumcZYnd0J8Oq+G1q0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386628, "uuid": "a7a390d0-3424-4260-a8b3-768433b793bd", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386628, "uuid": "2d3591ad-7220-4732-bae2-fbe1b303bf76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386628, "uuid": "d13e54b1-69ce-4bab-8792-549383cd8b1a", "value": "REQUEST QUOTATION BID..pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5434670-9380-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617346710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346710, "uuid": "394f9789-db5f-4b67-935d-3275dcf6fa49", "comment": "Malware payload (Gozi)", "value": "7af5ddeb66a2cbf7e73b5cc9308b77e5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346710, "uuid": "724c5a7d-9dc3-4047-9b0d-062d031a4e12", "comment": "Malware payload (Gozi)", "value": "b291572c8fa826fb9d1be1701525b40499dbca0950b7fefefe7c496058f07c08", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346710, "uuid": "b27aa6f8-341f-4bdf-a251-0832574bf114", "comment": "Malware payload (Gozi)", "value": "0322fdee364cf7e18bf2cb21c4118ecff50ee05f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346710, "uuid": "10b8dd6d-3537-4ce9-9caf-e4cf293b2744", "comment": "Malware payload (Gozi)", "value": "a0e9581b5de47f97b94b78662173a895f2ad015981fc06efbbb7e35d068a0330bf58a60ae79bd00218ce0be5d67d9504", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346710, "uuid": "1e064392-6093-4f9d-b7af-2543df23fb74", "value": "EB83F113DF55EB02F4A852BABE472BDCBF01242C999775EF02400B4B7D682364B4E5AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346710, "uuid": "3937d336-9b0a-4a54-ae28-c6acf851e939", "value": "1536:Q1f74wjcFSdH/MpFyY9ZXlk8qtZ0xaPgoy8+JmipkmvvtQSFBR0PfyI9LMRfWBAM:Q1zVNkpLZ1k8g05oyDJmipk4vykYARf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617346710, "uuid": "963d7e78-c2b4-4c7c-ab1c-ad72d2c9c415", "value": 82323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617346710, "uuid": "48f76e0a-1880-43ee-ba84-5f14e848e83d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346710, "uuid": "1cc6e88d-f558-4979-a2b3-c663ac4cf7c2", "value": "particolari_04.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132b46dc-934e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617324910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617324910, "uuid": "4fdd0a61-ab63-4fdc-abde-4c744bcc584c", "comment": "Malware payload (Dridex)", "value": "54c374542bb768247c79eb10bc89605b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617324910, "uuid": "7138e04d-c431-43ea-a8ec-543d484e014d", "comment": "Malware payload (Dridex)", "value": "b36b70b1a420497275dae7e89b0c1e57096ae6ef002e1d894615a60b7e9203ba", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617324910, "uuid": "6473f888-17ab-46a0-944c-f431ba794ecc", "comment": "Malware payload (Dridex)", "value": "7414e6d6eec3d6aa71b3198577ea357fe678c908", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617324910, "uuid": "121a41c6-8a24-4956-8ea5-0606f7f7d871", "comment": "Malware payload (Dridex)", "value": "9ee4dfcb790fcf8edde179411e97f0406dacee953e17a280a871e697986f0fc87e1e752f8927a6803ca81fe413e9a175", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617324910, "uuid": "d666dcee-784b-4d72-83e3-61208cd36b2a", "value": "6F14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617324910, "uuid": "b8ca8287-225d-4694-9e49-aa64ecb339a9", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617324910, "uuid": "7f17831f-0a81-4e20-b7c7-77976c87d178", "value": "3072:Sopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:lpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617324910, "uuid": "f2052b93-3eb0-4012-8945-df7614e649bf", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617324910, "uuid": "5139fa16-e915-4ed0-82df-5fe9dab594fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617324910, "uuid": "7ccff44f-1f24-400d-b327-b7f4f4097966", "value": "b36b70b1a420497275dae7e89b0c1e57096ae6ef002e1d894615a60b7e9203ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "128ee0a1-9370-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617339512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617339512, "uuid": "bca6573b-cf41-4ddb-9284-976733086348", "comment": "Malware payload", "value": "1901561a32860ddf4c4206733e83cb7a", "object_relation": "md5", "Tag": [ { "name": "mariotessarollo.com", "colour": "#65BC8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617339512, "uuid": "6f381716-24bc-4889-aa47-bd193550d920", "comment": "Malware payload", "value": "b3aef457af50e243ad61b37cb157ccbf054d2731546ed31947452798c17d2c22", "object_relation": "sha256", "Tag": [ { "name": "mariotessarollo.com", "colour": "#65BC8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617339512, "uuid": "73ebd8c3-fa63-4ee0-b987-e3ab5210a6a2", "comment": "Malware payload", "value": "85b3bced5e86a3af3f648305c3464dfbe5bb6dfe", "object_relation": "sha1", "Tag": [ { "name": "mariotessarollo.com", "colour": "#65BC8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617339512, "uuid": "d65099f1-7da1-4d8d-936b-f891044dc879", "comment": "Malware payload", "value": "5da25fc700553d843a0e411438f4608733d5922d88e84daed5127d7e8e02a6a1fb8b2942863ef40026ead203a8e23ad2", "object_relation": "sha3-384", "Tag": [ { "name": "mariotessarollo.com", "colour": "#65BC8D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617339512, "uuid": "ce3f6c1c-2ca1-4b73-a29c-f0b7aa00ce1a", "value": "27C32C66FB60EBF0E93989F61E120A6800DB3C7147195647F5C5360C3AF26CCA9B8797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617339512, "uuid": "c584f9a6-91ed-4c33-99bb-4364c37a1e89", "value": "1536:UEGnYf/fDllzpTqdKk9hcxI5jJMHwT+p/CBt1pXVPsgmo3WVnGoxe90h2Pe9hgfz:UEGYf/fDllzkKkTjJnypKBDq67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617339512, "uuid": "f02eaee7-2801-472c-b76b-756d929e4d2c", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617339512, "uuid": "67ad8668-076c-49fd-abea-27dec8912c4f", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617339512, "uuid": "155b9bfd-37ea-46f5-97b7-d41426c1fd4d", "value": "otb.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "675966b8-937e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617345667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345667, "uuid": "6759c301-5313-4c18-a58d-2693979db870", "comment": "Malware payload (Formbook)", "value": "15a1e83a49feab2166842863982b8d15", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345667, "uuid": "b2048662-9526-4759-9fe9-0b37ada643ed", "comment": "Malware payload (Formbook)", "value": "b502d8da5e084f6412b6c5081c4de851bf8c7e3b8dbd6636dd8420482f8d4c1e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345667, "uuid": "08469c9f-93ee-407e-b69f-f533edec126d", "comment": "Malware payload (Formbook)", "value": "ca724ab6d329650c4f465a214b1808b38d3c24d5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345667, "uuid": "233bb6c8-c351-490f-a546-b6220be878e7", "comment": "Malware payload (Formbook)", "value": "b73141bebe2d9ecdbf9e8ffa241a5cd87b0c0f8c89d29ede1859f0cb8afb2a74fa4534c40627a936880c708f5526abf4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345667, "uuid": "f6c97e92-6181-4804-ba12-c67c916ea9e7", "value": "71C423D8B2C3C539C25E25055D3F70BC96B28608C8957ECA4D3E3B96BE3A51633627C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345667, "uuid": "09b63cd7-7472-4cfb-873e-3a46dc130cf5", "value": "12288:iNJcwOnP/6bKuMy9uYELcHNsOAu/vBQrGJtCBarY9u6ciC:iNKwOn3UMyXdHNspOBwGJtCje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617345667, "uuid": "a76dda2c-4f01-4aea-9694-eb0912a5d62c", "value": 591094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617345667, "uuid": "e8d48a10-36ce-4c10-a126-65e123e37386", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345667, "uuid": "fd36b75e-b7fd-4b09-aaf6-e810dded0b18", "value": "REQUEST FOR QUOTATION.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7cfd22d-9398-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617356969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356969, "uuid": "94f95f7b-f711-4d20-9bd0-6f89cead51a3", "comment": "Malware payload", "value": "b585f210fa314dc102243e3210ea4d32", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356969, "uuid": "4b0a19b5-7b99-451c-8171-5edcf074d51f", "comment": "Malware payload", "value": "b5b67ed7cbbc6252dd7d37cf2ee58100bd96c089d06fefd16255c0021e7405de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356969, "uuid": "7675be5d-085e-4066-aa66-d7cf63d4b7db", "comment": "Malware payload", "value": "dc403fbbd01f8aebd5c215e2eb6ee0c18d364235", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356969, "uuid": "e04f4186-cb9e-44ea-92aa-18720fb4fd8d", "comment": "Malware payload", "value": "fc963851541c5bf4cda7bf3cb0058dce1303fae7b688947cdab37401028008ffb2d0d9d5f00d2edcfeb064b53c6cb58a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356969, "uuid": "755649cf-0999-4ea9-8055-32437f879312", "value": "B494234370EEE60F3114DCF1261FBE8A3274A58BD12644497AFA5E5EED341E8E1B8472", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356969, "uuid": "ef7442a0-90dd-462a-ac1a-e05ab72ea473", "value": "12288:Hm/2kxUIh2Z+JVVq5xZGZKyVpX8yjbEfALOdCJTl879X:HmukTgZIKG0UpX8UL2eTOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617356969, "uuid": "ed123c87-e59e-404c-b30a-c8201bbc15ac", "value": 437191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617356969, "uuid": "632ca4b8-a508-4ce3-97b0-c2697d9871a3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356969, "uuid": "f54105cc-ff41-43ff-9629-259a49d8b50d", "value": "TT Payment for Shenzen Lancer------PO-TZI-1804------------01042021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf55897-9394-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617355231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617355231, "uuid": "155d29bb-9e34-418b-aabf-f267cf0596dd", "comment": "Malware payload (SnakeKeylogger)", "value": "aad8b493ecb001b0d7c21ac0255c388d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617355231, "uuid": "107d7761-ed13-41eb-b837-74b4f80fc4c4", "comment": "Malware payload (SnakeKeylogger)", "value": "b680719c246b40421f39453184724597d00f8703355ecc094355f37be7f1bc53", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617355231, "uuid": "9469ce3a-72df-4939-8678-2cd1fba4b0af", "comment": "Malware payload (SnakeKeylogger)", "value": "ba860f57159dddd483505f4e007d1af1d187eadc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617355231, "uuid": "3758ffc3-3968-4dc7-a94d-b727ac68d97e", "comment": "Malware payload (SnakeKeylogger)", "value": "3bb1f577720c66512895afef4ec22980e995058189e77ed21bdfe508f3ec73ed33831e43fbf9e846c6f2178c0c423f6a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617355231, "uuid": "5031e1c2-564c-47f7-90b0-6f2ebce8833a", "value": "2BA423469C3E5C20F9F976BF0611045CBFD41A0B5FAED8CED49386A4E5B26F6BE20012", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617355231, "uuid": "d952ce3e-be97-4808-9798-9028ed7c4780", "value": "12288:P7fIseFeEO9igyT1WQ6WRM81g4/hDEGRUvv7ILbn:P7gJFeEKa1WQ6gng4/hDBUX7In", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617355231, "uuid": "e4bca432-96f3-49a5-9c41-1c5f8a752ac3", "value": 477224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617355231, "uuid": "1dc6bc82-ccd7-44f3-944f-5a377867eea6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617355231, "uuid": "1254ae3a-71ce-4b02-ae10-d5b4cbdff81c", "value": "ASB Swift Copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10fcc8ac-9392-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617354112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354112, "uuid": "c3a0bac7-dd29-43fa-9643-4294a8aef4a1", "comment": "Malware payload (AgentTesla)", "value": "9e11fb8e16efdb52c21e70817816173a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354112, "uuid": "ae91e615-df41-4cc5-8683-79ae424f4ee9", "comment": "Malware payload (AgentTesla)", "value": "b6e6023d1b3b0d62b6d20825ab7a993c3cda55051d56b42bf40db27fdab761b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354112, "uuid": "a135ccde-1a53-4324-aa35-35cdf4c35954", "comment": "Malware payload (AgentTesla)", "value": "8434a7cec087f3d4959a69c9d1edece90f7a403c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354112, "uuid": "3e111d7d-1fdf-44da-9d31-92f24f40573a", "comment": "Malware payload (AgentTesla)", "value": "76da32aabd53034ec74dc71f086c07f237781415c946cfef5d13599b768007b5d338ce1bfa683edd21464556d84fc171", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354112, "uuid": "bba6ff6d-4dc3-4028-969e-105ad17d1ba1", "value": "BCD4F9D1F150C8DAED6B09F1AD2BA53024D7BE9C94A4410C56ADBB1B76F3342209FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354112, "uuid": "2364bf07-a438-4a56-87f2-535f7d5f150a", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354112, "uuid": "f7d53248-c05f-4a7f-9e1c-afdf43cb932a", "value": "6144:09X0G5o8yaWXrivRM7YZ/XJrEWKmG1mmQKCbZB90ns55bPwfqXX7kAsyKaF:60sI89BrBKmfKCF/0svAqQpvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617354112, "uuid": "161f0f81-0f90-4152-b34b-201155c37083", "value": 637263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617354112, "uuid": "e0799fa5-bf0f-4414-89ee-faf71ac25456", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354112, "uuid": "662f8901-c8f5-4460-9cb5-a9120854b1f7", "value": "PO_287104.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4dc7a4d-9386-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617349340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617349340, "uuid": "78983012-deb0-4e7f-b0b4-00c2d16e9dd8", "comment": "Malware payload (Dridex)", "value": "2990f0524f7c56698a02c28cc6dea2e0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617349340, "uuid": "c623cf17-615e-49fb-b285-360418e2a6b1", "comment": "Malware payload (Dridex)", "value": "b76e92ce8cfd1c16a30e16bc89f12bcc06a14dfe49324d94fe75b737d51929c2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617349340, "uuid": "ee078d49-fa0f-4fdf-90b2-3d7165a04b6e", "comment": "Malware payload (Dridex)", "value": "c8d3b66106ad364ffc74c4180368c48f7fccfaaa", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617349340, "uuid": "10566a81-ebd8-412f-b972-ccdb8d756b6c", "comment": "Malware payload (Dridex)", "value": "a21c16a65591a9772bf233a307741dfcc5f92685daf64a89b3fde37b4099802e3a9b6a2c1e02352bd9eb44eefbb49309", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617349340, "uuid": "16814e9e-52eb-45ad-a41a-9762c5f51e47", "value": "18248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617349340, "uuid": "c369c05f-efe4-40d1-a340-99160e3aba8f", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617349340, "uuid": "56a422fd-4743-4f1f-a6da-baa2457c7092", "value": "3072:O6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:OoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617349340, "uuid": "88ecc305-f9a9-4353-a139-0c6cc0ce0a68", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617349340, "uuid": "e56740b0-15af-48dc-8031-bb655a4a3788", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617349340, "uuid": "b0220ec2-c43a-4fa2-ab7a-45c4a6c9320b", "value": "b76e92ce8cfd1c16a30e16bc89f12bcc06a14dfe49324d94fe75b737d51929c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3807918-938f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617353123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353123, "uuid": "e9c2b5d2-b153-4b85-9158-ac144e2f2584", "comment": "Malware payload (RemcosRAT)", "value": "bf516ba1c29314e4465653629cd046d0", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353123, "uuid": "20bfd5fc-7dba-47aa-b928-05b16ad85979", "comment": "Malware payload (RemcosRAT)", "value": "b8a4956db8253c2f13ef71e65911f6aaf9cebee9883b87c3dfd21bfa45d166f9", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353123, "uuid": "70228c49-cb36-4aae-b2d0-f58a275a76a1", "comment": "Malware payload (RemcosRAT)", "value": "654d61e0548cbebad9c02742147f1387a6f52a23", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353123, "uuid": "05609998-1148-4aa1-9cea-2603914b1802", "comment": "Malware payload (RemcosRAT)", "value": "a11226dcab632ec97af0d53a0a30354e3f27938a286f4caa54d8c2221e8e47323e2aa819af615868a481b45929da39a4", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353123, "uuid": "41dc5506-800a-41b8-9f61-6591160549ad", "value": "819312C8D53934CDC5F47592A22C0CAF10ACA1B234751A1792A346F3DA4A77C5BBE3A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353123, "uuid": "09de579c-513c-4161-b732-b37c340629e0", "value": "1536:wEU5Uc0cpa3kWnIYF/m30ngul5ad0fi6ua85zOabIeMVw/XrPvX4PaPdc7B:wrK43WbF/m30guCd0fafIeMVwDPPPlct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617353123, "uuid": "a51a3c43-bd46-41e2-8d0b-d4907b98a441", "value": 95617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617353123, "uuid": "1b6c51e1-fe2e-4619-b931-609db9c9dcdd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353123, "uuid": "35d5ff51-c607-439c-aeed-348f56e63949", "value": "fatura 893454.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2f396d-9376-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617342450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617342450, "uuid": "9d6a1387-bd5d-4599-9b51-b2402d7b5bcf", "comment": "Malware payload", "value": "5512180f20e8279acc4d71abbfeb2433", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617342450, "uuid": "c2b94bb4-30a1-4ddd-a76e-9c5098f695c3", "comment": "Malware payload", "value": "b8b0a5451344e49b72f422d3fa16c49eb0e3864f2b6c58e539e2e9774cd60824", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617342450, "uuid": "9c89f8e1-6aa6-444f-8834-7e0b53341716", "comment": "Malware payload", "value": "78270dd460923df854103efd85d248617da6f9cf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617342450, "uuid": "679308a9-07c4-4e6f-b9b6-c8b8d3ab6085", "comment": "Malware payload", "value": "46359d9694da39b0ed16e01d7dd39b666417d088fd89778c6269ff53c657acc695ecabb4f1ffb64c064c9de4d46e4f4b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617342450, "uuid": "55c3215d-ba3a-4f96-9364-45a94015fc3c", "value": "4A636D80206D00C8DAF9DF715B7D5E8BCB6007263BDAD41F286C74EE575E6621AE3607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617342450, "uuid": "f05f440b-158b-442d-88c5-ae895b72ab38", "value": "409c7c1ba51d89659506cf4700331508", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617342450, "uuid": "be01b523-03fb-42d7-8161-c852885da371", "value": "1536:DqFTghmBv//NxscRzNVSkTF9hqyNHgUZ:DNhW/MCqkTjhqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617342450, "uuid": "afb72d6d-8ee6-4f5f-b579-3c3b3eda639c", "value": 70144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617342450, "uuid": "2e226b9d-f717-45b6-9611-95140e1f0adc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617342450, "uuid": "1b682cd8-0df9-4c9c-8662-2750be262ed0", "value": "yosgu.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6128d6f8-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617386459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386459, "uuid": "35ffad3f-d81b-46d1-87a6-ca23ff2554ea", "comment": "Malware payload", "value": "82b25ef2a9647dc637bdb85f200074dd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386459, "uuid": "885aa743-b0bb-453c-b73a-3a28b4f09e4c", "comment": "Malware payload", "value": "b8b7b85d33303302e70b18bafa9e7789d8beab4510f8fff80648dcfcf5676cc7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386459, "uuid": "1ce2a06c-6694-4f12-a0dd-430a2747f191", "comment": "Malware payload", "value": "910aff233c13d24316da029a707f7aa5e87b3717", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386459, "uuid": "6ca7979d-82b6-414e-b1cf-63d79fdee61f", "comment": "Malware payload", "value": "121e9b1cbb45fb0a2a570a5d06591d3f85e1c25043839ca689ddd3190e7aa769ae3ede3aa5ad1150b472534e5df5a0cf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386459, "uuid": "0007b3ec-493a-4800-9f9a-5f1732396b47", "value": "C95359069ED18657D888863EC4E7036577359D4302A3CB0B4F58FB95EDBA219CF2BB42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386459, "uuid": "e10fcbdb-cb58-4a9d-b0e0-fac95de13096", "value": "1536:DbYfWYgZH3UY2t0nVDiB6le0n2yFD6vX3:l92yFDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386459, "uuid": "873be128-8511-4caa-83bd-5c512823c83c", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386459, "uuid": "90397a77-6087-4a96-8ba7-6d652d83aa01", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386459, "uuid": "8c0d8671-eb48-4bea-9e5f-0738d600ac9a", "value": "Company Catlog.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32b6d2b-93f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617396904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617396904, "uuid": "475dad7b-1dc6-4672-81e4-b393e6e0b691", "comment": "Malware payload", "value": "f55d1c9ff4776d951171cec02d512aad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617396904, "uuid": "004e7b14-6ee4-49c5-9573-2e128053bb7a", "comment": "Malware payload", "value": "b97c0637f9e4666bc0c4875a83f3224b241056be6fd34b32c52911bcf5841195", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617396904, "uuid": "a9a6e3e1-d094-4855-9481-9706d983fd7d", "comment": "Malware payload", "value": "db15476a2f6758bc33ed2d8a2f73596738e24517", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617396904, "uuid": "753e2271-6428-4c9e-a6d3-f6d3978baf38", "comment": "Malware payload", "value": "4a884a0364e229112fbd44181019b833536a48aba56d6dd2be6ba1a14f4b4a61266b4036327293902033c001053a1d39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617396904, "uuid": "1a636c17-a91f-43c5-9ccc-c40a9e493eff", "value": "6C545B0027EC8B55E2FF8BBDE0B1526187B1B462F97EDB8E5D4420EE1923740D945BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617396904, "uuid": "0b417f63-6d72-47d0-8276-dc99ead42e9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617396904, "uuid": "abe97eb9-36e4-42d1-8d30-016a7c5109a3", "value": "6144:cf+BLtABPDdtNoC56e3zJKiNp41V6GIeyX+RA1D02brZ:itqe3zJK6Y69eyXj1DTPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617396904, "uuid": "70415dbc-4082-43a4-9e38-b461df953aa8", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617396904, "uuid": "0fceb32e-d184-492a-bff4-12c7e722f38d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617396904, "uuid": "836ac42c-0f39-4353-9427-eb31c2ebb74b", "value": "Insidious.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc7702c-9408-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617404920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617404920, "uuid": "4c681be4-478b-4d6d-b673-fd91cc4efc37", "comment": "Malware payload (Dridex)", "value": "baea8829d8bec4d7a84b727b4cb8ae19", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617404920, "uuid": "6dab0e7d-7cfc-4e31-b225-0e69bd634780", "comment": "Malware payload (Dridex)", "value": "b99b5076a20fd93a976a2abf10d6ae40796e576a1c142d4bed3da14b4bdaec73", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617404920, "uuid": "5d3bad23-83ab-4fec-9c2f-f3d3110d154d", "comment": "Malware payload (Dridex)", "value": "2555d0470ede37ba18dc061ce0d0b6241cc00a87", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617404920, "uuid": "532e7eb5-658e-4093-9010-d79c744f1b73", "comment": "Malware payload (Dridex)", "value": "87dd56a379c66b9183dc0bc43c7a2d876baf5c1808c76cd8df3b8c1f9ed68a1a9c338421ea7146bf676b50033b0cef63", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617404920, "uuid": "84f9d4d0-0448-4593-8d51-af9f0cf283e0", "value": "F714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617404920, "uuid": "4b28c7fd-dfc5-4b20-87b1-25a53dd4cf35", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617404920, "uuid": "f4d9efb4-170b-4652-9ec2-c08eb432207f", "value": "3072:/opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:QpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617404920, "uuid": "b7190bfc-7315-4621-899d-84383678353c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617404920, "uuid": "f235b655-0853-474a-9efd-854d322d537b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617404920, "uuid": "e0c90502-d67a-4bc5-b643-854de581e0cd", "value": "b99b5076a20fd93a976a2abf10d6ae40796e576a1c142d4bed3da14b4bdaec73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7200d3e9-936a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617337095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617337095, "uuid": "6360e7b3-f492-4877-8d78-d2d1dbb0a61c", "comment": "Malware payload (AgentTesla)", "value": "cd2d3196a9ca4d2993df5a56c2268a8b", "object_relation": "md5", "Tag": [ { "name": "#AgentTesla", "colour": "#28F413", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617337095, "uuid": "5def1fb9-37b4-4fd4-a2d0-bde4781d83c0", "comment": "Malware payload (AgentTesla)", "value": "bad8f00ba21fa345e1ef7a8120ef4b8468f719e5c9214372864ec65f187f32d5", "object_relation": "sha256", "Tag": [ { "name": "#AgentTesla", "colour": "#28F413", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617337095, "uuid": "86029d72-58f3-4b6f-b5bf-c61abbde4735", "comment": "Malware payload (AgentTesla)", "value": "6707776ac0e2f6ccb959e884022f8bd7e55d25d2", "object_relation": "sha1", "Tag": [ { "name": "#AgentTesla", "colour": "#28F413", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617337095, "uuid": "04dccfa9-9945-48bf-a506-6033c354d1c7", "comment": "Malware payload (AgentTesla)", "value": "b45c2698ddde72a07e906daf098cd302cc6a684fc7e830b5c9646c7ab86ffe15802f2f93a90a248c348ac583a2a810e6", "object_relation": "sha3-384", "Tag": [ { "name": "#AgentTesla", "colour": "#28F413", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617337095, "uuid": "f621502f-5181-4d13-8d93-baa51cb4ec2e", "value": "29E4592337877BAFDE7843B61452411033B0AD76E76AD50CAC54725D4FBB6C08BAE262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617337095, "uuid": "afda1418-2e0d-4c68-aed1-e16cee3a6586", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617337095, "uuid": "6a329ee4-76e2-4390-80e8-c66762c6ae85", "value": "12288:CdO87fjVPCMbuAydFxQpaGjx9O0fRiNCB72ZFBcDSr1nr:C/VPNiA6jQAGPs/r1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617337095, "uuid": "b523f71b-2c9c-4881-8ede-1645e7981b20", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617337095, "uuid": "77285168-2c08-4f66-ae1f-2f7b1be6f9f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617337095, "uuid": "cd6a88cc-63e6-4f7c-969d-489d976bd4b9", "value": "jvHeNF9w44bZiiL.exe_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb6145b5-93ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Makop)", "timestamp": 1617393053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617393053, "uuid": "f8a62883-9166-49c6-aa86-70f09e1f7f1b", "comment": "Malware payload (Makop)", "value": "67d32736c5e1300c21329f956da836ab", "object_relation": "md5", "Tag": [ { "name": "makop", "colour": "#0769ED", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617393053, "uuid": "a43e167d-2b2f-4d90-bc9b-f56350e065ac", "comment": "Malware payload (Makop)", "value": "bc0ed3e73b8d1fdc839f2e8ed3578ca3221dba4eb984e581cb00dfb4cdfb7d49", "object_relation": "sha256", "Tag": [ { "name": "makop", "colour": "#0769ED", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617393053, "uuid": "c4913948-5ad5-409b-8c8a-d3d826c1ba7c", "comment": "Malware payload (Makop)", "value": "15c705cc01650bbf0db7bd0229edadb5f4ee9cf7", "object_relation": "sha1", "Tag": [ { "name": "makop", "colour": "#0769ED", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617393053, "uuid": "2a66dcae-3328-477f-b567-f144b3194260", "comment": "Malware payload (Makop)", "value": "4bbb4963ed255265077d0e2d3f0cdc424f67a8b46718fde3e96f98d7dbc5527600a87f4a95d8131cf031421fc05d7528", "object_relation": "sha3-384", "Tag": [ { "name": "makop", "colour": "#0769ED", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617393053, "uuid": "14673de6-89ae-4710-b942-50544b4cc7d4", "value": "61F28F46E281C6F3EC8405B976DFA71AFDEEA40913B552D3CF14EC6138126D278BE482", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617393053, "uuid": "205a442b-2741-4f68-83bf-570302570392", "value": "b2a2e59916055b004c7a8f339a45d95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617393053, "uuid": "75778d65-85fc-4d80-96e7-4855b05cfb87", "value": "768:e4HLd8Vdh9qV1Esg8kdJCzSIZHkKRV6kNDGA6slD9tc:eQ8VIV1U8ZGURVFGhsN9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617393053, "uuid": "2296370a-724e-4809-8702-24bc58057c23", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617393053, "uuid": "0f05ff51-6554-4e81-b7c4-f1edebd87660", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617393053, "uuid": "6760c7eb-198b-4454-92f5-a7f8cfa338b8", "value": "bc0ed3e73b8d1fdc839f2e8ed3578ca3221dba4eb984e581cb00dfb4cdfb7d49.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a35cd4-93d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1617381626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381626, "uuid": "bd7ea1ea-ac04-4726-afb5-80cd11839727", "comment": "Malware payload (STRRAT)", "value": "c5e9a3e1ff7ca78edbc173ec4cac65e0", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381626, "uuid": "530b8cf2-00b3-443c-8390-c91044b3b4bb", "comment": "Malware payload (STRRAT)", "value": "bcb9857db47e01bc9b351a08a0064c019efdd5502d67e5793b257c26985256b0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381626, "uuid": "9986789f-630b-4080-b519-95144c0dbe06", "comment": "Malware payload (STRRAT)", "value": "c5edb5291325fbd298be84bfe021e9c1976af5dd", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381626, "uuid": "c754869b-5e15-4788-9078-0b2019ce32b5", "comment": "Malware payload (STRRAT)", "value": "1597e4044e3bd95e31f482c2246bd2866c0ebafd1cd35155ba52e37a85f922be6a9121fa411a1baf73de5233bfbf78bc", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381626, "uuid": "e04220da-f1c8-4037-8b29-59d73a8bfde7", "value": "A3A3CFABFCA680F6D59F2133405D8262E30E929CD05761BF21FC44461DB9C39674AADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381626, "uuid": "80b962b4-6cb6-4b21-9b80-776e965c9e45", "value": "3072:Ux/e/TVGGTG3kdB7GEMGLCOkIbEowRujAxcku2:Ux/0xGrkdB7yGL5IowRUdku2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617381626, "uuid": "effa1940-4d9b-422d-a675-fcb00ecef48b", "value": 102145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617381626, "uuid": "f636cbd7-0af2-48aa-b4b4-c753da11f4b3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381626, "uuid": "61f2af26-fa43-47d5-9753-9f2202419f35", "value": "Our Quotation Request file.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1481b0ef-93a6-11eb-abe1-42010a9c0039", "comment": "Malware payload (CobaltStrike)", "timestamp": 1617362708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362708, "uuid": "d0265a5f-14ec-4c7b-9c34-2c5f7d63a729", "comment": "Malware payload (CobaltStrike)", "value": "ae4c5124a7f146c66dfb9ed72ff1734c", "object_relation": "md5", "Tag": [ { "name": "99.81.122.12", "colour": "#6905C0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362708, "uuid": "41c6c493-3c22-4b4d-99c4-4bc1817bc660", "comment": "Malware payload (CobaltStrike)", "value": "bcc27ec0fba8c23964f386378f67b66907e3ec030d9b545d96fbfbdb42c4932e", "object_relation": "sha256", "Tag": [ { "name": "99.81.122.12", "colour": "#6905C0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362708, "uuid": "8602e004-3ab5-4b16-9acd-96a0b8267c7d", "comment": "Malware payload (CobaltStrike)", "value": "e24fcb7b20297174843d8e4cffa887f141e4b63c", "object_relation": "sha1", "Tag": [ { "name": "99.81.122.12", "colour": "#6905C0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362708, "uuid": "050506ca-438a-4b45-b99c-e161823f14cf", "comment": "Malware payload (CobaltStrike)", "value": "27cd9d73004263d85f812ceff1720a7f194ad64fbfab8f89d38bac47cbefb30974066d9d4603df3671f43383329b0825", "object_relation": "sha3-384", "Tag": [ { "name": "99.81.122.12", "colour": "#6905C0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362708, "uuid": "483f1bd4-2773-4910-a38f-12bee0ef4c49", "value": "A182FA3FB24224AAC97FD038C8DA5372ADF3B523516B671D1AB4DA302F60DB8593D905", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362708, "uuid": "99f01d0d-53e5-417b-97d0-c00b37c293f1", "value": "bed5688a4a2b5ea6984115b458755e90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362708, "uuid": "13474059-0439-4d21-aae2-95b6653cb75d", "value": "384:7K0JgSnWwsmZLMqvXbYSEVsBFMY6Y97wFwP:7BKxmZ9fbYvqFMFMKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617362708, "uuid": "4cf2cbc2-8f31-4b04-b0e9-fa63dcd53390", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617362708, "uuid": "24ce61de-ea16-4092-b904-e1b314edcfde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362708, "uuid": "7523fefc-6e52-4190-aec1-0692e77f4016", "value": "bcc27ec0fba8c23964f386378f67b66907e3ec030d9b545d96fbfbdb42c4932e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e62be60-93bd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1617372656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617372656, "uuid": "938cd153-f517-4a9b-a2c7-b18e4aa93316", "comment": "Malware payload (Vjw0rm)", "value": "b679f29a0f5908f2a2800f4640414a6a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617372656, "uuid": "508a5f69-4c0c-4eb5-92a9-cae6042c79a8", "comment": "Malware payload (Vjw0rm)", "value": "bd355bed434a1f877fe2690fae1f350fe154777e2c2edebd93b0d0512c9b557f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617372656, "uuid": "61a2841c-a362-4446-af3c-865ff5dca6ae", "comment": "Malware payload (Vjw0rm)", "value": "e042ae8354b72ea74627437194d1c137212f76cf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617372656, "uuid": "ded4b76a-a5fc-423d-933f-05f9519526e2", "comment": "Malware payload (Vjw0rm)", "value": "c8742f18b855dcb234e2f465c996dbe02f89f1ae8a05302ad33cf70a51a36a0925c7eada145795755fcdf3fba1172431", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617372656, "uuid": "9314118a-a51c-4c1a-b1f8-b2574af2db31", "value": "1681209C2C4B863C57D23B8B802DD148CDF548B47F28D2B6148CDAC5360E97987B69BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617372656, "uuid": "f46302a4-02c4-44b7-8ac3-851e8e3c72c0", "value": "96:SABNo5DZk2c24ZRMHXE6/BIe+Ys+fJpDdQqR7bJyKheOS4UK:zSa2c24ZRMlBIVYs+fJFfRffp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617372656, "uuid": "a7fdaf7e-6ef0-4f83-a039-a396ba4864e4", "value": 3879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617372656, "uuid": "3a717fd4-727b-4fe2-b330-3b68dab0d860", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617372656, "uuid": "e65de58e-c9aa-4bac-8cd1-0d2a74da59bd", "value": "Inv41029.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c9cb78-9357-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617328912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617328912, "uuid": "92831423-4baa-44be-824f-5c07fa3e5fce", "comment": "Malware payload (Dridex)", "value": "e5e0de62563314e83b50a7cfade10997", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617328912, "uuid": "00a4fead-e808-4070-b99c-d83bfb9e7876", "comment": "Malware payload (Dridex)", "value": "beed0b6383ba92d98244f41704bb2e930beb09d95a4c7768ef70d80e9285367f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617328912, "uuid": "c45dba5c-14eb-4474-9c8c-6d2b4b8e5f55", "comment": "Malware payload (Dridex)", "value": "80752341f7e040663043fb0fa88506d20685a5ff", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617328912, "uuid": "cb6df0c8-eb44-4a05-a8eb-4559f3149a58", "comment": "Malware payload (Dridex)", "value": "b615fc6a33ae433c2263f77befe440a7d1b18106b2efdcd98afb5aaa781f3e4ec55704a934de54ad5900714bab2f3975", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617328912, "uuid": "491d75d7-b2e3-4241-ad85-9f5f32c7c033", "value": "0514AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A6FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617328912, "uuid": "672ebf7f-bd24-4c71-8b96-bece1f8c9103", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617328912, "uuid": "d5da8e97-eaa5-4fa5-a470-8472429b8599", "value": "3072:w1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:si78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617328912, "uuid": "1b0ab67c-a0a1-4611-90d0-8795c12d53aa", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617328912, "uuid": "e24526e4-3c19-4c10-b42b-e020a8b869cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617328912, "uuid": "571208f3-1d91-453a-93e3-3d91da45b911", "value": "beed0b6383ba92d98244f41704bb2e930beb09d95a4c7768ef70d80e9285367f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a0f04a-93df-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617387186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387186, "uuid": "f9a195e5-0f45-4a78-8c5b-33a4cebca16e", "comment": "Malware payload (Dridex)", "value": "39d9467ac08c8d3d7aa532bb042c7440", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387186, "uuid": "e1b19153-796d-4437-b3c3-6a239adc3fab", "comment": "Malware payload (Dridex)", "value": "bf5c1e1b6d4abf1de1e239c7cc9f3aa0a8e6fa84b9c14578e4d70bcb10dbc497", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387186, "uuid": "53ce01cc-6f18-4acd-85d2-8a960e8013e8", "comment": "Malware payload (Dridex)", "value": "1c4b32116b26f648ccc23b41fecd380c7a782186", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387186, "uuid": "8f2c46df-7c6f-4adf-9df9-c5f884306bc4", "comment": "Malware payload (Dridex)", "value": "9c4b438b7db8a68db70ceb40bb0928a7631a696be84e4edff11debdce940c5e3e9cdddd1894f904f81b25881f143e4bd", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387186, "uuid": "077b3dd0-dd1c-43ff-8b13-391cf4ee2ea8", "value": "2714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387186, "uuid": "31b30665-6075-4144-86f7-977cdb036f75", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387186, "uuid": "36914e4a-819b-4fde-aa44-22ccd576c776", "value": "3072:Copj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:VpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617387186, "uuid": "ca15b33b-c8eb-4a62-a4f4-63c9a0a57936", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617387186, "uuid": "7c5774bb-f0e6-420b-9f5e-4a6d472410e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387186, "uuid": "6eff314a-2dc1-46fe-8e21-2267e8caee62", "value": "bf5c1e1b6d4abf1de1e239c7cc9f3aa0a8e6fa84b9c14578e4d70bcb10dbc497", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e66109a-9370-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617339505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617339505, "uuid": "efc6e701-ceb0-40e3-a15d-5be8b27525c7", "comment": "Malware payload", "value": "71714c975383be9d962b333987e4eed5", "object_relation": "md5", "Tag": [ { "name": "mariotessarollo.com", "colour": "#65BC8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617339505, "uuid": "2fe6b9fb-db32-4c2b-a82e-42fc48bb010c", "comment": "Malware payload", "value": "bf6c679446314890a052275205cdcdbe7987873a648cb2bec25f41e6895de6df", "object_relation": "sha256", "Tag": [ { "name": "mariotessarollo.com", "colour": "#65BC8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617339505, "uuid": "42672fe6-cf56-4927-bcbe-eb1c88ccf3f8", "comment": "Malware payload", "value": "fa68a5c6e50fd21c882ab3ab5dd5b739f1c08a78", "object_relation": "sha1", "Tag": [ { "name": "mariotessarollo.com", "colour": "#65BC8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617339505, "uuid": "34be8c5c-2a6a-4dd7-ab5b-3c9c2a35b86b", "comment": "Malware payload", "value": "da00471565e7f262d62e915ce2e2bcb9975bda432833c5b7d1de1832b11d246d414dda1dc39ccc24cae733e6c549797a", "object_relation": "sha3-384", "Tag": [ { "name": "mariotessarollo.com", "colour": "#65BC8D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617339505, "uuid": "462b6a13-7f07-460f-9ab0-40348f9570f8", "value": "10B3085378A48FF5DE724FB54EB1876811836D301BA24607B9D6374C0AF3A8DA5683CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617339505, "uuid": "4263cd55-12d3-488e-a28e-fc2ac4e5e321", "value": "1536:OUET0NTOoq9SlvXyWSNJOMDcKlvLWCvp:OUETwTOdSlvJaNoUvqCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617339505, "uuid": "b1e52988-1c70-40ec-9f9f-75d1addb7b70", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617339505, "uuid": "64516889-9e42-42f8-a044-baff74835032", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617339505, "uuid": "e07b5345-cdb5-40df-ae9d-9e789e0e2b3c", "value": "cp.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b98fedba-93b3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617368568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368568, "uuid": "95cb1ad5-a414-42c0-ae38-4ee7e0031136", "comment": "Malware payload", "value": "e462b06d82894c0e3efe75250fa64103", "object_relation": "md5", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368568, "uuid": "392a7edf-a9d6-4c4d-9c97-c61e212047a5", "comment": "Malware payload", "value": "bf6e3cf654738116a14be298176fc12524154ee51f9a2424fa117ee5b47be53a", "object_relation": "sha256", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368568, "uuid": "420395fd-4ae3-46b6-8e4a-002bae80cef4", "comment": "Malware payload", "value": "084e56438a8d4be566a1fdbeceeba22a7b7e289c", "object_relation": "sha1", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368568, "uuid": "2c67d18a-6536-4541-90bc-af574e9f26d7", "comment": "Malware payload", "value": "e111c8a08f01e578bd233bc4474c2d902fb9a24a4fa113b6f11fcd7ccadbe24e9aec1c21c031891dd531f8059889e740", "object_relation": "sha3-384", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368568, "uuid": "6bede30d-a525-43ae-a2b6-59f6b49873e9", "value": "93F533363161D473E22700308A9953E676FBB131129A5A8B7BDC0E3E77951F1836AB4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368568, "uuid": "1be6eb92-8472-4ac3-b437-2e995ac39ed4", "value": "d32519c93924bb24d9874d86c5993ee3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368568, "uuid": "8cb278d4-89ba-4403-9715-aacc4fdf27bb", "value": "98304:fa/hwP/wQ2+KKSZQIAU5xDmta2BBXzpsy:S+jSZQIBXDkDpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617368568, "uuid": "b10582f5-3e58-4318-ab72-d1bb5ccadd0d", "value": 3422325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617368568, "uuid": "801787db-b0a3-4124-8928-caa3bea26519", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368568, "uuid": "ac5091c4-06ba-470e-9d3e-6585f2b495cb", "value": "Donate_Caper_Fixed.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86257d9-93a1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617360835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360835, "uuid": "6acf7c07-e753-42ec-82ee-872d0e2e9ef2", "comment": "Malware payload (Dridex)", "value": "948ec3a4c494eeea53ebb2f84f9114c9", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360835, "uuid": "8b087295-7e37-4b73-9a57-23efd1aabb98", "comment": "Malware payload (Dridex)", "value": "c0e3bbd9299e19a5dcbf476b706c236e8ac61a00449c7415725448869bbf1fb8", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360835, "uuid": "88ba92f0-6b2a-4de3-a9d4-e4c71e7cbe9c", "comment": "Malware payload (Dridex)", "value": "adcd0c32fa4c1ee815e214ce60cbe6eb06209992", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360835, "uuid": "bc08ca53-028f-45aa-9a32-358147ce20ad", "comment": "Malware payload (Dridex)", "value": "27d2f3b93155d8b820d5a182799fa674c15093c0258185313198e3c6287815c54dd869f1da4e9fa852a2bcdcff83aca7", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360835, "uuid": "3345118d-230f-4302-9ce8-3663088f443f", "value": "A214BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360835, "uuid": "c3378a27-a6ff-4f29-b708-72fe865c3975", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360835, "uuid": "49406a9a-1e91-4ca0-ab54-44e5ce847a49", "value": "3072:mopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:5pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617360835, "uuid": "a6ce5bb1-5f62-41b4-93cb-8d2ed6c17177", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617360835, "uuid": "ad1e05a5-7e13-470c-a341-e01d5bc5b57b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360835, "uuid": "b731cbf7-7da2-41cf-8117-ee1907e645a7", "value": "c0e3bbd9299e19a5dcbf476b706c236e8ac61a00449c7415725448869bbf1fb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c0dc50-940e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617407477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617407477, "uuid": "7670eb51-ae09-465e-8ad0-582e585dbf43", "comment": "Malware payload (Dridex)", "value": "f920d407959ec33d1c07d67d2c74a32d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617407477, "uuid": "c9b9eabf-08c3-463b-a979-3ea39bf22d89", "comment": "Malware payload (Dridex)", "value": "c107d683feb0a9dcf6a089b51aa294504dae82ff8a78652a7d3fd957aae6ae2e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617407477, "uuid": "77f435b3-5b0d-4419-9332-c343e1e95842", "comment": "Malware payload (Dridex)", "value": "56e9acbe953a000cce181337db96da3437154f94", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617407477, "uuid": "825c8fba-a055-445d-8d3e-d3744a955a4a", "comment": "Malware payload (Dridex)", "value": "221edc229c72e0d30e2518e6ac43c7f19d297b54fdce14c4ed16c1cc72e9d90d7094981594bbf6f48719375fdf7addf2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617407477, "uuid": "64ce1c4a-4270-4483-9d24-7a97f3348b0f", "value": "EF248C5FE339E486FEE3CAF44186A72296A39C92476F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617407477, "uuid": "08dea1f8-b22a-40bf-93a7-c20a26ff88bd", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617407477, "uuid": "a854528b-d12a-4f4d-8921-baf5cfd01415", "value": "3072:f6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:foMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617407477, "uuid": "735f4839-316b-4d7e-a2be-842861d5046f", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617407477, "uuid": "ee61bb8b-a8d3-40a3-ad2d-05ab850093db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617407477, "uuid": "9519ec1d-64eb-44df-9248-bbfb40f478b6", "value": "c107d683feb0a9dcf6a089b51aa294504dae82ff8a78652a7d3fd957aae6ae2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a533ccd4-9367-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617335892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617335892, "uuid": "c433e5eb-2a20-4e89-b288-8f8b264f938a", "comment": "Malware payload (Dridex)", "value": "9c93ca9dc4005b3d1d01d6885723464b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617335892, "uuid": "7815a38d-771c-4234-a80d-2e65f6a90e7d", "comment": "Malware payload (Dridex)", "value": "c20039f17a2b0f5d8bed4af6cfb24b163b66657455f19dc700ec886645fb6574", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617335892, "uuid": "689df38f-6647-4ea6-ae83-03c3130734c6", "comment": "Malware payload (Dridex)", "value": "d4146309c64bf76608c4e4d07fc435416fe0f048", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617335892, "uuid": "92a61334-03ba-4493-920a-410ea40ee2b6", "comment": "Malware payload (Dridex)", "value": "51b644ab9f421d8db86c7df2c4a5087b0bc70005cd52b33e78cbee00529e6a85d60d18710f657efc1893ea70978babae", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617335892, "uuid": "944bbb14-80e6-468d-a962-90e1bb233c68", "value": "3414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617335892, "uuid": "e97a05a6-53f7-47d6-bceb-e79ecd1bf599", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617335892, "uuid": "2505d809-e723-4933-a4a0-072175bed2bc", "value": "3072:/opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:QpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617335892, "uuid": "2a22dbee-029c-4ac1-b4f9-01babd721868", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617335892, "uuid": "bec9c8bb-3428-4484-8661-9238d1efda3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617335892, "uuid": "fca524e8-9365-4c5c-b23f-9571f7041297", "value": "c20039f17a2b0f5d8bed4af6cfb24b163b66657455f19dc700ec886645fb6574", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a762a4fb-93dc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617386147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386147, "uuid": "4a2d9501-ab1d-4e8e-aa23-9f62b5cbb160", "comment": "Malware payload (Dridex)", "value": "0b9f07774b672188ea750618b9a7a62e", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386147, "uuid": "1e86348a-26e5-45f9-9ec2-27086c4370d0", "comment": "Malware payload (Dridex)", "value": "c52ee1e021b95448d3b1fa5a47172abd509cbea4f9028de15ee7458c3da921a6", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386147, "uuid": "13b24a89-cb0b-4784-b78d-8961329b0697", "comment": "Malware payload (Dridex)", "value": "c83b1319276614ee645cdb238444fc8a5ba789d9", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386147, "uuid": "dc6f3876-8656-40fd-afd5-98d0c7071152", "comment": "Malware payload (Dridex)", "value": "061f49c1e612440c962d72fe18a9557ffdc284511319a637777d8ce3bd6e296252bd3cc7c5c23c9673dd987238f21e18", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386147, "uuid": "51543a77-7742-417c-9f60-25de5a02b71e", "value": "B214BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386147, "uuid": "7233c8df-de99-4292-bd2c-b6a928841324", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386147, "uuid": "503c8a78-4f77-4fad-b664-bc3efd963dd7", "value": "3072:Popj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:gpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386147, "uuid": "7324d701-9a8e-4d1f-8772-86c4b38d563e", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386147, "uuid": "b69121a4-73cc-41ce-a223-0469775fb090", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386147, "uuid": "51c4f2c3-8d5e-4ec7-9643-fc95a433aaa9", "value": "c52ee1e021b95448d3b1fa5a47172abd509cbea4f9028de15ee7458c3da921a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60695b5-93c5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617376293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617376293, "uuid": "b571e0ec-0ca5-4141-83f8-c6ab3132eb02", "comment": "Malware payload (Dridex)", "value": "a0e6cb352c11457101b83d80f239056b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617376293, "uuid": "11b98e3b-ffa2-4a78-b418-08ad70867c19", "comment": "Malware payload (Dridex)", "value": "c5cbebfd7b594e1f99b699ecf963e904112fcea7e77911224bc8fccc6b0d4c7e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617376293, "uuid": "3b79d3f0-12e1-4ff0-95be-a9b125d04773", "comment": "Malware payload (Dridex)", "value": "b1b87e6ee2a8fbd21a63a46b4334e3eee10ba96a", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617376293, "uuid": "0b1b39dc-d642-4d8f-8896-833cc7669971", "comment": "Malware payload (Dridex)", "value": "d2a0d0594051deaf417e389296a65b7d2c375d9717651f37e71f79837565e6f70de07ce746f1dfedcebcee7aef1d45a2", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617376293, "uuid": "9a138a7d-02c6-4aa7-92f9-725603e9a12e", "value": "9C14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617376293, "uuid": "ba724179-bc46-4d73-b335-601adf65e5f7", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617376293, "uuid": "86784385-a3ef-454d-b903-ef2ee7203a87", "value": "3072:aopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:9pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617376293, "uuid": "e1b87330-152e-4470-a802-3599aae1b558", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617376293, "uuid": "95a6184b-93e3-4c57-b0bf-959d562bd516", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617376293, "uuid": "c219cd83-689e-4a89-8261-463fb8df3882", "value": "c5cbebfd7b594e1f99b699ecf963e904112fcea7e77911224bc8fccc6b0d4c7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423ea4ea-93b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617367509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367509, "uuid": "a853bded-9799-4e29-a54a-167bdf386112", "comment": "Malware payload (Dridex)", "value": "4028a7aba65961b998232b1e85e7320f", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367509, "uuid": "2a38abd5-fa3c-4b24-9507-75a0180c7e36", "comment": "Malware payload (Dridex)", "value": "c6e37ca9dfff4decb25dac2d1f7bfda5bc3c531feae3f110241b5983f5f7462b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367509, "uuid": "dddfaac3-10e1-416b-969e-257243d2053c", "comment": "Malware payload (Dridex)", "value": "a2d5b084b11b548635a587fe04560f5f14cba4ab", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367509, "uuid": "d4e90553-f3f1-4265-a38a-1df8f8f4472c", "comment": "Malware payload (Dridex)", "value": "301736b83619a2c19d0ea68264745a5ac5ca5e751435f3de595ab312d3d84af30de122ab4e3ccecf19fa4240d1c037b6", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367509, "uuid": "7399bb55-18f7-4483-b535-d156de6abfa0", "value": "CB14BE4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367509, "uuid": "fc4225c1-ed78-449a-b677-a719648cb1df", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367509, "uuid": "82fc1ade-31f0-4b45-86d4-3696cb026851", "value": "3072:9opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:ypjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617367509, "uuid": "7036c6f3-2032-40c8-ad0e-779986748fc0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617367509, "uuid": "7155c547-8da8-46b5-8758-37f2fcbdd823", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367509, "uuid": "3ae907c4-d95d-41c2-a54f-502283cfc278", "value": "c6e37ca9dfff4decb25dac2d1f7bfda5bc3c531feae3f110241b5983f5f7462b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fdb1404-93df-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617387208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387208, "uuid": "c5784f84-57cd-480d-a898-e9c7e25f32d2", "comment": "Malware payload (NanoCore)", "value": "a4aa442f8ee2ba7b6bbe16fe88723449", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387208, "uuid": "dbe0bb05-db9d-4198-a012-24a1bdb81ce0", "comment": "Malware payload (NanoCore)", "value": "c70dd61e5434862cf116e5b486a1f8431040c479e408bf05fa97be244f8f09ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387208, "uuid": "57005542-cac7-4485-88db-3e90726a6cf0", "comment": "Malware payload (NanoCore)", "value": "136a221985d71c1b8e54ebb0ff402c014decf7b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387208, "uuid": "6d8f10fb-fe83-4aca-8738-e8f1bccb5778", "comment": "Malware payload (NanoCore)", "value": "f28252dfe316c84548efecf6f325f548b8f97eba85269d6bb2c2a7433fbe5fd1e0d704b730072d32ce63e40f6739b175", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387208, "uuid": "efbf1e7b-f40b-458d-8fd7-225db870651a", "value": "F6D4A1A870AE405DEEB46B74F5B545821FC825321F62FF3F28E657005CA3B69FA4E910", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387208, "uuid": "f1b5ac7b-816a-4a3d-8b4e-0c2c44f1830d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387208, "uuid": "50481483-6865-43da-91b0-a9c218175cc1", "value": "12288:NAggzhl2beSTBntR5rVX6JIEGtj5p1pB/zR4oFj:9UEtR5rx62/R5p1pB/zGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617387208, "uuid": "e6cca09b-9332-462c-9f9e-b42b3c8a8cec", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617387208, "uuid": "01ca3cb1-8342-4ccb-8770-cc8f3d5632e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387208, "uuid": "7a5bf619-c072-4acb-a47c-0cc4a6fb8f4d", "value": "a4aa442f8ee2ba7b6bbe16fe88723449.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a0e6ed9-93b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (DCRat)", "timestamp": 1617368757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368757, "uuid": "7bb714cf-73d6-4250-9780-16e4778f4c07", "comment": "Malware payload (DCRat)", "value": "0c0aa53929d9088efb86e7ac7a68c8f8", "object_relation": "md5", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368757, "uuid": "2bf0e6fe-aab0-44e3-b550-274b49426120", "comment": "Malware payload (DCRat)", "value": "c77a79785de7336c777bb3d65e0914c39c265b81494b50c64ce835cb9712855e", "object_relation": "sha256", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368757, "uuid": "01dc59d6-f766-4042-950b-dbbf8b7fa34a", "comment": "Malware payload (DCRat)", "value": "1da77a547279b7df56ff4b344ece93a068221721", "object_relation": "sha1", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368757, "uuid": "a7aacdbb-0e2d-4dc8-ae5f-311059c930c6", "comment": "Malware payload (DCRat)", "value": "9acf499caa186f98a120b60d628e85e79efa73c7e143da350cd74843712ab0089fa9664bd5d58b36c41123331b496bed", "object_relation": "sha3-384", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368757, "uuid": "c10824b3-9529-4add-88e9-7a738dacef69", "value": "2B358D027A4CDD11C1BA1637D9EF85148BBCFD406A22C75A7E9A37DCA4613A36D0F1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368757, "uuid": "90b72c0a-cc0d-4df2-95b2-745999f4b546", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368757, "uuid": "1ca60a2d-7595-4b59-8378-344cebbd6826", "value": "24576:U2G/nvxW3Ww0tdK4TIIMVrt8BEysXteqWBd+4:UbA30dQxVr8JKHWG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617368757, "uuid": "4a361a43-147c-4d04-84fb-d67f3dddbf2a", "value": 1096795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617368757, "uuid": "fa7ac1ee-e04d-4233-9a92-6efe6c9d5ba3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368757, "uuid": "2dfe685f-6bcd-4b76-8d6e-5a5b97f6b1cc", "value": "DCRatBuild.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc50af26-9380-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617346695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346695, "uuid": "c0bc5e96-85df-455a-8e88-9f8da3eae345", "comment": "Malware payload (Gozi)", "value": "a3516c7ca2ef4c5dbd5732026d0bd37f", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346695, "uuid": "87a0c0af-b573-4de1-b4b2-ec42f81adbde", "comment": "Malware payload (Gozi)", "value": "c8931b54afc05c5dabed83f134b8e7cde8ef6a61dee4eeaba9ee4514931f5b97", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346695, "uuid": "ea1dab03-3cb3-4126-94f2-0bbb3387778b", "comment": "Malware payload (Gozi)", "value": "046e25bb5af34d9f5f69a0a3155f244ef4534dcd", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346695, "uuid": "fd2183f1-a470-4c48-91ed-ec0f13513228", "comment": "Malware payload (Gozi)", "value": "eab2dc1bba2e8ee1a5da7b75a063242e487a29932a277827c4ae95c0f4fe741050917a8abcc2feacd13326c15bb327fb", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw8457712", "colour": "#3604B7", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346695, "uuid": "03dfe0a7-225a-4177-ab32-4d341b38b24a", "value": "6383126E8DE668F9A164D3A8DF7432ED35EE41EC1D0B8AB8C4DD200187DC6FB05224E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346695, "uuid": "37efd4d5-eb47-4cd5-beef-0e65d6262f04", "value": "1536:E1P87ESe1/m/6YBs/9h3PuU5EYz2dxIjDqnGKaA3lY9wavfvRPkDj+:68wN1/mP2UwEB0qnh3lY9wav5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617346695, "uuid": "25b04ebe-b59b-491d-a5b1-b79bac0db765", "value": 88564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617346695, "uuid": "deb505ab-c3a4-4cf7-b7a3-59f884fcaeb9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346695, "uuid": "c5e3c646-6ef9-4b46-8986-6c7c5f30f5ef", "value": "request_2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a087ba-93ac-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617365466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617365466, "uuid": "54f8fb3a-9e42-4b61-aa9d-d7abecc357a8", "comment": "Malware payload", "value": "609c2473571bf703ce985b6e44b8e343", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617365466, "uuid": "fb09a38b-f709-4364-acca-6789621a6d90", "comment": "Malware payload", "value": "c8ef6d5139e6175dfa05c9ad6942343277a6c5ed8723472dd508d8d0235714d6", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617365466, "uuid": "fd361efe-ea04-4991-a771-fa4cc2abe6ed", "comment": "Malware payload", "value": "81a5705f8fb316d120607d3a43e437d41f5c275f", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617365466, "uuid": "b0d179d3-6e4d-4059-87bc-bbd8244600af", "comment": "Malware payload", "value": "35ba61618aa2b4e1bc41be7b4424356d17ec867d91c8a82e0ca48d97834f7e648d3b4cd4631845a654de663f6ce28cca", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617365466, "uuid": "140c0c6d-9931-48ed-bf24-ba54b9911f6e", "value": "42E533B2C6E871B7C4A70E39452946C0D243068EF6AAED3F6B81862C5BD355F0F5235B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617365466, "uuid": "98a2cb36-00bb-4b07-8a00-ee6f8b9659fa", "value": "98304:mBNe9iSLToQuMkvX72hJ80VOLb8khrEzm+c9SwFSZPgnAiueci5G:mG9iIkf72Y0cIqAz9InYejG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617365466, "uuid": "44a9d7f6-084e-403b-86f9-ed4e45a71288", "value": 3204527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617365466, "uuid": "d5050af9-d39b-4978-99b7-5cc0fca3ea87", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617365466, "uuid": "75490552-0b36-440f-9555-b5bb3a526927", "value": "\uc6d4\uac04KIMA2021_4\uc6d4\ud638\uad70\uc0ac\uc548\ubcf40330.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec91b8a0-9396-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617356198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356198, "uuid": "297cb8a8-7236-4f23-a4e7-94218ec57747", "comment": "Malware payload", "value": "ab26a063249a67f47de35171881b9d68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356198, "uuid": "5a50d0d0-4d5f-4143-ac55-651ae17edd32", "comment": "Malware payload", "value": "c9c125210cf329d1729611e20e65658b745c38e5d9530788821642b050ab3ddd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356198, "uuid": "0434460f-d36d-4b91-a21c-e1cc72de98f9", "comment": "Malware payload", "value": "2f2936f00cd74804225817fae393fdf4f256b81c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356198, "uuid": "08473fb3-852d-4e4f-8d29-fb7b0784cd25", "comment": "Malware payload", "value": "3ca062228c9746a82b9f43035601aeb00aeab1b802aa9c4d492bf0fce41ccc9d7b05ec5358e7cce8b606514cfe5f6237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356198, "uuid": "e196bde0-bd30-44ec-8d76-aab31c529356", "value": "9E16FA990F7772C4B916DAAE18259F69B37D22F6C32D141D4333E0B06C17B9522EBC68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356198, "uuid": "7bfb6adc-f530-49c6-82d2-3b0fa7ff9ec4", "value": "6144:3DO/wz1WLdt0E6Z1wu1D06bZHQbzbLB3TsMCIBjLN8wZZ8kZCDGpax0n69qZKEr+:3q/wULi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617356198, "uuid": "fba56afd-5ce7-4218-b052-a1df817224b1", "value": 4249118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617356198, "uuid": "c4ea6449-c063-4dfe-9d3c-c040c004bd8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356198, "uuid": "5564a70f-732a-45b7-80d8-cf9eade15246", "value": "ab26a063249a67f47de35171881b9d68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22099e3f-93b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617370032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617370032, "uuid": "09b43e1e-c518-46a0-a9a7-f950165540cd", "comment": "Malware payload (AgentTesla)", "value": "650bb07c356904783587eb3b9d535607", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617370032, "uuid": "7b21ce07-33f4-46b9-ad5a-8f643f305aa2", "comment": "Malware payload (AgentTesla)", "value": "ca5ec53a9f7a0ab143fbfa164c2f14819af890c622472ea3f20e27a44d291491", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617370032, "uuid": "44f3778e-734f-4a85-81bb-a273b76dce1b", "comment": "Malware payload (AgentTesla)", "value": "48013417566d87a9b5ec2d09923aeb2203cd2b21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617370032, "uuid": "b4b7520e-84cb-4423-b58a-55906402b78c", "comment": "Malware payload (AgentTesla)", "value": "2b33d3c08b40f422aa48f185b8a567a1ed4a88d87933c1aa6ed0f361cdf564a78ff86752140a3d519857fe4331837ea7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617370032, "uuid": "c70805b5-601e-4dcd-ae8d-980a8190fcfb", "value": "9EC4CF14E3AC875DE17E17BB407032707FF9A491E666FF89EEE110AC19623818562B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617370032, "uuid": "f2f8b7ca-932f-4089-91a1-1fc0565d99e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617370032, "uuid": "57901478-55ec-4fa0-8a99-08f263389774", "value": "12288:kAaEmEx0PukW/0O3/2drqeZptTWrB0acPpHDort:k3EFkWMO3udmqtTYmbPFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617370032, "uuid": "a2545352-3898-4aff-9202-cd49e1844681", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617370032, "uuid": "2a2f55b5-ee7b-479d-b8b8-d8677ae25cac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617370032, "uuid": "41bf9346-5360-451c-9290-6e3e6e5ef024", "value": "Swift Copy#947026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed96da0-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617386535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386535, "uuid": "128eb2d9-a5dc-4ecb-ba92-769ff6ee62fc", "comment": "Malware payload", "value": "556e1a2ae229e794d0cfa27a7de4807b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386535, "uuid": "3f51b65a-ed1a-4858-aeb8-3d10200e39fb", "comment": "Malware payload", "value": "cadfb13da23174d0653b3f0b67f1776a5bceb1eaa87ad4e8759fe890ab11aa9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386535, "uuid": "e5f767be-bf1e-4129-938c-1a2d3ed4591d", "comment": "Malware payload", "value": "de469cb8695e355b696335de7fef611eec5e1a85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386535, "uuid": "b45066c4-4614-41d9-ab5c-b4a9c87c249b", "comment": "Malware payload", "value": "47cae5c8f7b470266c0b06256ee9c8a39a61cbd598aa38810a6af3454ed0abf56716a23b750cfea1c0dbb554f459c307", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386535, "uuid": "6640e9ea-bfc5-482d-a1ab-52eed3c44e72", "value": "736631605DAF376698B31F8C275128050D226D10FFA34763168AE5287E83D8AEF75E7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386535, "uuid": "91213745-63cc-4dc6-bbd9-220b38e10102", "value": "6144:CdJiGOtn6ZE4hxslrUm9TI4HVqyAJm/VOZCtxj0VkagEKqGps2guLlIYMcLd:eiGOtL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386535, "uuid": "49d31e9c-a3dc-48a2-a102-048d88edb9f1", "value": 6643223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386535, "uuid": "99ac7cf1-b22e-40b2-b847-592a64ff3887", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386535, "uuid": "34687df0-3fd9-4b6c-9638-ead869b0939c", "value": "556e1a2ae229e794d0cfa27a7de4807b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da25501-93ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617371420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617371420, "uuid": "112aef4f-04f8-47e3-9581-97cb2d6e4eaf", "comment": "Malware payload (Dridex)", "value": "7da337a88662ca37ae6acc40582fc5ce", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617371420, "uuid": "a0db7a0b-567b-47dc-a33b-d088283014c6", "comment": "Malware payload (Dridex)", "value": "cb96b87b1fd950203dd09a27b7b25cff7052d059f6289ebe5189dce15f5b95b5", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617371420, "uuid": "528a23df-ac7d-4bc7-aae3-86adf52b5119", "comment": "Malware payload (Dridex)", "value": "099e728bec6a23400bf5ce6240abb617bc40d729", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617371420, "uuid": "a18cf934-4ef9-4501-8590-badfb0a35f5f", "comment": "Malware payload (Dridex)", "value": "8a66dc9cacc7d627002d90fd6f90ffba80773621cda7be95e44da6ede35be2fc3902bcec718e8fcd42e18072147ac326", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617371420, "uuid": "90f2feb5-4c6d-4bb1-b437-b3cb7c7be35f", "value": "9D14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617371420, "uuid": "9a7aa7db-c51b-4d7c-a38f-4ff48aa9206e", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617371420, "uuid": "3b2ec4a1-a3b2-4e39-841f-55b284d288df", "value": "3072:Nopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:CpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617371420, "uuid": "64f3800d-023c-4159-8b73-5a05aa4aaf3b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617371420, "uuid": "e5cf4a6c-7324-4e48-a930-9cd56ffa4621", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617371420, "uuid": "bcb747f4-98b3-4fbe-80b8-e5a73ed1ce36", "value": "cb96b87b1fd950203dd09a27b7b25cff7052d059f6289ebe5189dce15f5b95b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0f2aab-93e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617388272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388272, "uuid": "bf98eedd-70b8-4955-80f4-c301d164f022", "comment": "Malware payload (Formbook)", "value": "bfc6783549515232c84b6a68339bc859", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388272, "uuid": "178b29ca-0c15-4f2b-883b-a06e131b5b8a", "comment": "Malware payload (Formbook)", "value": "cc612d0e4c7c76e5effdf680ab60c85a0e2ba22a59bb6a0dd02a13153ead0a50", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388272, "uuid": "278dd430-7329-450f-89da-24e0d37e0af9", "comment": "Malware payload (Formbook)", "value": "a3d04f356a976fbd30f14af9220fc60a0a094c95", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388272, "uuid": "504f3678-3a86-4586-965c-df2f72fc7c34", "comment": "Malware payload (Formbook)", "value": "642bbe69db38b8520367cfb5eca656a1280510b40e449c8b262a3f2450e72712df56bc3979185b20e5bf9ea857492ae2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388272, "uuid": "27cbdfe6-8795-4e50-95b8-5f3a376716dd", "value": "3645125907F0015BD86F5B7067B7D6A2F37AD600253742A737EC2F2B6B0168AAD1630E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388272, "uuid": "c55449cb-b2d6-4ec7-b994-dea5b879ac7e", "value": "3072:0fTs3BxJNmJBD8bH8qwEiVpx6eoNIjDa8xwF/QDFyBoEPasdC54V+J/STqMmJbRx:6APFaP6ZGva8CxQxyBPasNYSTVeVWj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617388272, "uuid": "ec830d57-f002-49f2-9eac-827ff7ffbb4e", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617388272, "uuid": "a4b133e2-2158-46dc-9ef2-f84d49d0f66c", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388272, "uuid": "e54f57a4-cf06-4c86-abf1-7bd482b2cf58", "value": "Payment_03262021.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26400051-93d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617384642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384642, "uuid": "816d85db-8f60-4099-98f7-3bb82ba68123", "comment": "Malware payload (IcedID)", "value": "6ea9e6f4ac96a49d2ed6239190f3cb46", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384642, "uuid": "35b3e4a0-03bb-447d-9d75-fdcc85a0f95c", "comment": "Malware payload (IcedID)", "value": "cf7958a90e919c98464b8fb3b7a204af7f66d9ab82549243cb82c619cb5607c1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384642, "uuid": "2b734e07-e5a6-4dab-9914-5b4729e1d295", "comment": "Malware payload (IcedID)", "value": "a558cbf7550c334d14d10336f2d098ae6f19d09d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384642, "uuid": "298329fa-8224-41e8-8a1c-de98fd5e6c72", "comment": "Malware payload (IcedID)", "value": "785f1468b204f8ed069e1c756313986986837c52dfdc245f6bfa5e7901a58cac654a3c0882dbd88c0589118d54dd2c93", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384642, "uuid": "1d00574d-24f1-4b86-b9f9-d61ff45e716b", "value": "31530A8947503C91C0FEBD34F3A69A58931EFB30AA8F47B794C46BBAC47B5409723619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384642, "uuid": "7d853b98-8a49-4d4f-9b86-4a0172ca0511", "value": "eb10ff98c4adb7472a591c82bd2ff673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384642, "uuid": "76542375-6501-4c5a-89d1-495bfc3aaec1", "value": "1536:caCAzXz8T6rLXah8lI+Idu+B3XbuF6dRiF:n/gTkXayetu+BbuUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617384642, "uuid": "29a1168b-d5cc-4b71-b7c5-f292bf60cd70", "value": 65568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617384642, "uuid": "60da7767-63e1-4f69-a169-b81bce1c5d8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384642, "uuid": "1375558c-5229-4979-b4fc-3c773a888bfc", "value": "cf7958a90e919c98464b8fb3b7a204af7f66d9ab82549.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d9ea41-9389-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617350441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617350441, "uuid": "07b9675e-5473-423d-baf6-da151e3ed2d6", "comment": "Malware payload (Dridex)", "value": "a660c63aba2e236d0fecbaa926c76699", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617350441, "uuid": "1b8fbd5d-9c69-44b0-9a4f-39827e4facbf", "comment": "Malware payload (Dridex)", "value": "cf86afc05de7c38a5ab3bb13d4660026d994fed094ecd6c3148f9848bc6d4860", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617350441, "uuid": "f30c6cd1-4c9b-44d2-a06d-5a50079aa8cd", "comment": "Malware payload (Dridex)", "value": "27c33d3d401f04856eb832129f5930f0c7dc6035", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617350441, "uuid": "2a53bba2-38a6-498c-a9c9-3833216fd01a", "comment": "Malware payload (Dridex)", "value": "1eb018e1161e9be279164d4ebfac7634f4d2acae438b714b2b5c6e193b97dbe0f8647a165104a6e1e07feef752f849ea", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617350441, "uuid": "89cffbe2-d828-42f1-ae90-5956df2a1ea1", "value": "3514BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617350441, "uuid": "72aa75f5-ebf1-4be8-b803-d9f676d0e68d", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617350441, "uuid": "41fef226-33cc-43c2-9a5c-f4f06a3f57c8", "value": "3072:7opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:MpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617350441, "uuid": "ef981989-6bea-49a0-8cf3-0f657e7c23d0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617350441, "uuid": "bfc4bea9-7c09-42b6-9e53-3545178b15cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617350441, "uuid": "c2c4a2e4-7948-4ef7-9241-06fd67556eff", "value": "cf86afc05de7c38a5ab3bb13d4660026d994fed094ecd6c3148f9848bc6d4860", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd7b79f-9391-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617353756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353756, "uuid": "0e18c5c1-3291-48c6-9e3c-8092dbae199d", "comment": "Malware payload (IcedID)", "value": "faa384783abb0ca7edb41617d7bba4e6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353756, "uuid": "5ecb4eb5-9c6b-4e85-b9be-ef007472e3e8", "comment": "Malware payload (IcedID)", "value": "d07e2c046e4fb55e95f6acd59d50f3bdad2f7a96eb7d15654b3eb80551968401", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353756, "uuid": "b8480e9c-ed55-42e3-98b4-33fa0d3517ab", "comment": "Malware payload (IcedID)", "value": "d126542c9ea85cfac0ddfa0ed3e9ed4129d3f8ed", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353756, "uuid": "b51ee4ee-0558-4b21-8b4b-0aabe5246819", "comment": "Malware payload (IcedID)", "value": "0f5266cbef72358d51a5a6345323c199cd9684fe80979133ebbad8e5135e7454af9a701a1b98c98c797d1dadf51a631b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353756, "uuid": "84d3f2c4-e9f1-4472-8bf7-526085b047ec", "value": "EE14F7935CCFB663D42F90F1A8A1547D7F30BCC413E297DBA9084B1AD993792A972318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353756, "uuid": "a528b5fc-f44b-46be-92c1-41e3cebe1fc0", "value": "3eb5471c5370e4bcb3be6637e4995a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353756, "uuid": "ee8244b6-3cbc-46f8-9d7c-9de077f4110e", "value": "1536:Vq8ByBeZnwLGM+NoV1XjeNSaziIz7Ja5j/Nj/IXoZcq+M6qaCZZtr2wS+FJZLT:Q8+Kjv4RECZnrDSGZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617353756, "uuid": "966c8292-410c-4d21-abbc-f54dfff49462", "value": 203808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617353756, "uuid": "dd3a4f55-4378-4d2f-8110-d2d58040894c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353756, "uuid": "2166ab70-7e81-4fbc-b1d0-8bfa8a2c5e49", "value": "d07e2c046e4fb55e95f6acd59d50f3bdad2f7a96eb7d1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4425ce-93ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617378319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617378319, "uuid": "4b186a13-fcb7-4ded-823a-475edae61a58", "comment": "Malware payload (Dridex)", "value": "49adbbdcee892732b7bb0cb22d7542c2", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617378319, "uuid": "56707846-fbea-4cce-b446-0129f31e4bbc", "comment": "Malware payload (Dridex)", "value": "d1336c8024fa3facd28fa19063340f97261e51992c69738cdc05678ddb95cc06", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617378319, "uuid": "a46073a6-54dd-42ec-a1f0-d763b312f6d2", "comment": "Malware payload (Dridex)", "value": "98886a2e6e1725496b2065974b2a823f263fcbee", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617378319, "uuid": "0e1523c2-a711-4c7e-a9bd-8c012ade95ec", "comment": "Malware payload (Dridex)", "value": "a410306cb0108271f8d465a74a99a33f3699cfdd3f0a8350355fdbd9cd8d53e3825e42c7d2f6fb14728e37bb247fbf12", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617378319, "uuid": "a137ae34-fdf1-471d-bf91-baf3e52fce9e", "value": "B414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617378319, "uuid": "fdd1ea78-ff7e-439e-bde2-00b7e70e894d", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617378319, "uuid": "a13cb209-1625-4c3a-9d44-aa966057c34a", "value": "3072:oopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:fpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617378319, "uuid": "8694d755-20bc-4de9-a5c3-eae1b33b3ee9", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617378319, "uuid": "dc996c82-d630-45c4-b778-ebb3ed8fbef8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617378319, "uuid": "1a13ded5-e1b0-43d8-9da3-e0a6cef226f1", "value": "d1336c8024fa3facd28fa19063340f97261e51992c69738cdc05678ddb95cc06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f0f9bd-93de-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617386916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386916, "uuid": "61bcb976-00e8-441f-8d57-b2205aa40a7a", "comment": "Malware payload (RedLineStealer)", "value": "8621103b4eb43e077bf228a3d65ce604", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386916, "uuid": "1c40ccac-95c1-44f9-99cc-3370168608d7", "comment": "Malware payload (RedLineStealer)", "value": "d1413e28da1395166d0b510e83b9da3e510aa6ccaeb47f12681d94b0cd24e699", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386916, "uuid": "d4c4fbc6-f787-4651-a7a5-55c1141301c7", "comment": "Malware payload (RedLineStealer)", "value": "bc66f1390f53e1d1f367ff031ec9a78055a61f7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386916, "uuid": "7286d49c-1916-42c7-a122-5036b246e99d", "comment": "Malware payload (RedLineStealer)", "value": "fc96667bd5aea1e1a7e9c1ff735f375bceb9a681b32df20a1cac1b8de51f6ce82e70164ac3e1fb1b506bc4888609dfb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386916, "uuid": "eacfc4c1-b805-4e61-803a-b4f9afb61e5c", "value": "8B64F10171D1C832E6961A7948A9C6F5463AFC310F2446CBB7C51BBE1F263E29E37396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386916, "uuid": "373d7f5d-7725-4b7a-bf62-2337d91a0984", "value": "2d5121f754e69d5634d8bc69d91f466d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386916, "uuid": "358a59fe-63ce-4f50-9f78-dcd72f37b9b7", "value": "6144:WrVeJ0GxYJGqIXAAPSus+4BWm7X5hcf5vV5:3J0InAAPSWmLMfxV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386916, "uuid": "ac25b278-58c2-4670-baf0-d31cf73b4f14", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386916, "uuid": "1535d526-7327-4e75-941f-2b752107ddc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386916, "uuid": "394e280f-937e-41b7-abe5-5427ca0136da", "value": "8621103b4eb43e077bf228a3d65ce604.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fad66c4-93d3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617382108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617382108, "uuid": "78f78f7e-4157-48f1-b6e6-799e19b72572", "comment": "Malware payload (Dridex)", "value": "1311350a3339b396a10b7ec6acd0af78", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617382108, "uuid": "5fa36fc0-1552-42b1-ab40-b3f2769b4b2f", "comment": "Malware payload (Dridex)", "value": "d1b73b43b999337d86f4894a703eab982682897b9d0e9033ef5fc4be4aa5f74a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617382108, "uuid": "c5486a46-65c7-417e-a0ba-519b8b6ea2a3", "comment": "Malware payload (Dridex)", "value": "f7fc50ad5f08b73b82c410827c4afb1b9925f56a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617382108, "uuid": "79380385-8e1a-434e-abe6-077a3fc9fc2e", "comment": "Malware payload (Dridex)", "value": "4f617dd4edd9f0a0a36f83adbb104fb8d49611c4bc25ebe9e3ac12d52c226fe4b271f4eb8ad0a0961f88f0c4788d52ee", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617382108, "uuid": "a2ccf9ed-df0e-4b29-958d-4d039942fc95", "value": "AA248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617382108, "uuid": "84ebca04-5cf3-4228-86e1-a08e0e88e2c7", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617382108, "uuid": "8efbb7c2-52cb-4a74-ad29-5e95ffbc14fb", "value": "3072:S6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:SoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617382108, "uuid": "f179cd09-37c8-4399-8e8c-0f4b885d52ee", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617382108, "uuid": "221031d4-5fa2-40d8-a136-0eeb252d7ebe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617382108, "uuid": "c23ba501-eaee-4042-867d-7e17fe7d21cf", "value": "d1b73b43b999337d86f4894a703eab982682897b9d0e9033ef5fc4be4aa5f74a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da28031-9356-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617328551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617328551, "uuid": "7519fd3a-05e6-4e2f-86bf-72f999a19c3a", "comment": "Malware payload (Dridex)", "value": "3b4b0614072eae1e5b18d3d73b11eb0b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617328551, "uuid": "e4dcc509-d460-4b4a-a46b-531d32dcb9cc", "comment": "Malware payload (Dridex)", "value": "d2a35f9be9515599d287404f48f754b352fda79e5b0b4f7603fe8b6f15620b9b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617328551, "uuid": "08e29cf0-52e4-48d5-bfb0-aebabc36da72", "comment": "Malware payload (Dridex)", "value": "eef1217aec73dfaa8fdddeb39fc16e6bd0b5dc29", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617328551, "uuid": "54efdef5-4129-45db-b3d4-cce4f6b3589e", "comment": "Malware payload (Dridex)", "value": "2360f4c2824681bed2fcbddc9c7f3204de63b47bdda04df44678c8066bea75b8ef0458113803d43eb3dbda9d715d9aed", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617328551, "uuid": "734e7507-8376-4f5b-8ad4-9006f34cc07d", "value": "4414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617328551, "uuid": "7db58fe2-3a52-4435-98c4-ef9011467ca9", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617328551, "uuid": "b4fe2101-fb53-4fb5-a1a6-361980dbe3f3", "value": "3072:Xopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:YpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617328551, "uuid": "790fe4d7-2703-4201-8399-c5dcfbe0d974", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617328551, "uuid": "28a512b3-83ca-4b1d-9bb9-7b4bf5d9a589", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617328551, "uuid": "0c739ed3-4211-4da6-8bf6-a929b84b33b1", "value": "d2a35f9be9515599d287404f48f754b352fda79e5b0b4f7603fe8b6f15620b9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913f5e42-93e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617388257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388257, "uuid": "c489df6a-b4d3-48a0-b348-ed6a72f74249", "comment": "Malware payload (IcedID)", "value": "caa9c3b3d3cadc15d4ff1d19feaec729", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388257, "uuid": "301d5896-de1d-4bd0-82d0-565e2b8c955c", "comment": "Malware payload (IcedID)", "value": "d2a683a22cd0063f5b02df9970e19194fed1fea420f6f7bd28ca66d4eaec23fb", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388257, "uuid": "586e8b90-a118-4c50-8f28-235acd83811e", "comment": "Malware payload (IcedID)", "value": "70a8addacb632e0770b2be987aab8b41bcffa038", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388257, "uuid": "029f7ff7-c1a7-42d1-9214-54124285b6bf", "comment": "Malware payload (IcedID)", "value": "1c55515df3dec3d4c95d9c5f31cc155bbce66aa08ea098693248e518ac60e4137f5efe74aeb9ff1b786ec08efed629df", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388257, "uuid": "93af298e-50ea-4b38-b211-0f72033caaf6", "value": "A9B3B0BCCB06B0A7DA54DF3C814AB0918EA580732F1B722B158E515F09079DA2D3E67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388257, "uuid": "d65e43b9-c625-469b-9c51-9ce7121a77ab", "value": "3072:Y26TGqT+dY7EDzPjEwqtDlko+bJ99K7meX7pD3:YLTGa084jYDv+d9imeX7pD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617388257, "uuid": "a2e91f53-3286-408a-b1bf-47e64ded5f47", "value": 108510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617388257, "uuid": "64ee8adf-f55a-4264-9af5-3c103642913a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388257, "uuid": "f69eda39-64f7-4099-b274-236a2f40783f", "value": "document-767588369.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7480cd2-939a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617357827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357827, "uuid": "e2d08cd2-fb60-460a-aab2-cf90640e1061", "comment": "Malware payload (AgentTesla)", "value": "99e18d564086ec4adf3dda1b828495f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357827, "uuid": "22195722-c91b-43b8-bb54-543422ce50de", "comment": "Malware payload (AgentTesla)", "value": "d2e0198548e4d9b2adc585ec02f6f8a4240ee7cf2cb96696c99f216c570bf36b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357827, "uuid": "00a3b032-c8cf-49d1-90e2-dbe812a11416", "comment": "Malware payload (AgentTesla)", "value": "5d0f2cfd3aeafbb12314b038bfa00cc8eccf8cc4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357827, "uuid": "06fff238-f742-458a-8894-51d7d39ca513", "comment": "Malware payload (AgentTesla)", "value": "6de7a7a37d8530866cba562bd27e9966cd07dec329d9ec9f4b5de921868bd1f16c8110f102b0193cdae3b0ec710f6a17", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357827, "uuid": "b583915e-d638-485f-a9f5-963e466c7a68", "value": "0FB4BD3C31D58F57F16D8AFB4A12A50153F993A268A3F6C93C8758A524D23C1CAB16CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357827, "uuid": "2b409150-3719-4f68-961e-233c08b89360", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357827, "uuid": "ca33e385-f59a-4570-85a3-cd0b9440a06e", "value": "6144:GM9YHLxWM+jYfYqeZDcVJgc1Z49csjMuHJSnwyUerTvJSfROtKjDbENrDdQouwT9:GM9YSaeKVJnscxfrtSfNjDIldd9PUH6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617357827, "uuid": "15774826-ad90-495d-965c-959fd541ebb4", "value": 494080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617357827, "uuid": "fc1afdae-d5ff-49aa-8f3c-eeb5429f61f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357827, "uuid": "7cdc75ec-b355-490e-894c-7a9e14b4f310", "value": "Contrato firmado.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef52c25-93b4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617368738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368738, "uuid": "292b7917-f69f-4448-9219-38602decdcff", "comment": "Malware payload", "value": "80b52493358fc46a2d6ca55aba892036", "object_relation": "md5", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368738, "uuid": "9cd8b9fb-44f5-46f2-aa68-7de983f62c5a", "comment": "Malware payload", "value": "d31dcb27d98e4e58b3210b325121812395dc8f64c7c20398d8144346a10d7350", "object_relation": "sha256", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368738, "uuid": "9d43ee1c-731e-4226-9f50-70f1515f4431", "comment": "Malware payload", "value": "f179b063e4b9d4b5d49c0dbb5b23463243d997dd", "object_relation": "sha1", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368738, "uuid": "91825d29-c023-4627-9b86-f111b03145c5", "comment": "Malware payload", "value": "adf20105cc90f24298fb387e13caca71c48390e345c044b741a8c9eb86206d2a15b938d0a5d52ed7525274aab72a70f2", "object_relation": "sha3-384", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368738, "uuid": "adfbdc4e-174a-4073-88b7-43aaa5bfb48a", "value": "A755AE013A48DD11D1AA1636CAEF85144BBCFD407B22D76B7F9A376CA8123E76D0D1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368738, "uuid": "777f7df8-d7b4-4707-a50c-7fa863b120a2", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368738, "uuid": "6faf5860-7d0c-4d82-86aa-9dc32085cf3f", "value": "24576:U2G/nvxW3Ww0tfxMu6u9nGFVrMSJwqILO1+cBg2eFTz+4:UbA30fxGr4qIfcmjTC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617368738, "uuid": "97005506-83fa-4eff-a6d4-a5c75587c2d9", "value": 1280936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617368738, "uuid": "f315f4e6-afac-4a7d-bf5b-25a83cd19cbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368738, "uuid": "0e3264d5-496d-41c7-9a38-cfd3b0625a65", "value": "228.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7219380-93d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617384992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384992, "uuid": "bd379d4f-16e8-432e-83a5-465d08dedd0a", "comment": "Malware payload (Dridex)", "value": "a9c16c3d32529d92d6021a665366a4fc", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384992, "uuid": "a101884e-bed7-41c8-a75a-449ebddf7df7", "comment": "Malware payload (Dridex)", "value": "d39a0ba95a06b04edeaecc42c870662335d67fec05d0ec160ac8096898756170", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384992, "uuid": "a4de2f12-9d32-416c-8bb1-5eb4fc1e4b8f", "comment": "Malware payload (Dridex)", "value": "f11a99936bdc43261c236028088a9dd6d57df530", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384992, "uuid": "a49a2ffa-d571-4753-9910-8cd1bd453c36", "comment": "Malware payload (Dridex)", "value": "4c9cff1946808df52e7e494b4dd0b16a90ed90cd29706339151ab4ee0fd5f0128a16a7c5f971b4ceab7f7a6942bbec72", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384992, "uuid": "35056cf9-5d62-47e4-a0a7-0ec6c674663b", "value": "EA14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384992, "uuid": "5a0d1345-9215-48b5-a765-9be6be87eb61", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384992, "uuid": "97fb78f7-d074-4be9-a278-07c9b17f7587", "value": "3072:w1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:si78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617384992, "uuid": "421a203f-5cdf-423e-b52b-69a53b6b823a", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617384992, "uuid": "38b58f73-9ade-4e13-8ad2-85df75f9e0c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384992, "uuid": "56da4b98-fcb7-41e3-9a2e-a0aa80c0bd1d", "value": "d39a0ba95a06b04edeaecc42c870662335d67fec05d0ec160ac8096898756170", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a26ec3-93f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617395407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617395407, "uuid": "25542117-89ec-47e3-8d67-19be36b41b09", "comment": "Malware payload", "value": "137ddf979fe1b6f1d43dd332dbee7471", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617395407, "uuid": "9ffcb4ac-c830-4a0f-8a2a-624d26208db8", "comment": "Malware payload", "value": "d481fe92bcf5d34418829f620bfec20c4ef386e8825ea6301fa7be8208d09c09", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617395407, "uuid": "931fb09c-5c2a-4631-a347-9b539f079e43", "comment": "Malware payload", "value": "05ad90dc62c8b1d1b9f5b2be6c35007476887ba9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617395407, "uuid": "b4153cbb-4a87-4187-b92b-446541befda4", "comment": "Malware payload", "value": "e6cfbd5fcd2ed401ac9fe013aae11aa8c1863d4b6235280cff84fd17c8d3172115be735cd3b0335acc6f1ea0dc1beded", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617395407, "uuid": "5461d6c6-2482-49cf-9219-0f2afd259288", "value": "20C5335CCCF7D2BAE43AC9362921608DE0AA8F44C97B5B164EC1B0C74F94A493D6EDD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617395407, "uuid": "0847921d-feb8-45a5-b1a4-4e0043ea9dbe", "value": "49152:hHN7z2/4jngIJxw14sqCvMljpztNHN7z2/4jngIJxw1G:zX//bwOHCgpzFX//bw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617395407, "uuid": "d555cdd4-c8d9-465d-94d7-11b9689d6707", "value": 2566824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617395407, "uuid": "efa5853a-2a18-44f3-b64d-98f3636cf2ac", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617395407, "uuid": "2411f53e-81a2-44ed-9877-ab0ac6ecddc6", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a5a1116-934d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617324519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617324519, "uuid": "d8783dde-6fe1-4c70-8ad7-6f84f3b23e68", "comment": "Malware payload (Dridex)", "value": "dda25c572fa09b61d7e11f8c39729439", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617324519, "uuid": "062b4dec-65ec-46f7-9986-38ba51149abd", "comment": "Malware payload (Dridex)", "value": "d483cc18a2af224b7e647857fa49006a66d640b961579f8a9f5ddc5dcd3c8a0a", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617324519, "uuid": "8df503cf-7b9b-45d7-991d-4c5da2fbad72", "comment": "Malware payload (Dridex)", "value": "15d165c03928adc8f7b672d47998bb33eca4b568", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617324519, "uuid": "1325f17f-0f95-44de-b3cf-326dd97092c7", "comment": "Malware payload (Dridex)", "value": "4f8ff1fcc900db5e423c3d0a192ca93dcab2ac6a8317013a51b3d432d258b9fa477f10431d50767f8b48ba7e2c017e4c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617324519, "uuid": "f6e56340-25f8-46e1-8d00-868eaf9d05d3", "value": "9B14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617324519, "uuid": "74d0d2b4-93c7-4b0b-924c-34147a7dac3b", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617324519, "uuid": "aedbae3e-a9ef-483a-acb7-da5746b4f727", "value": "3072:Hopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:IpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617324519, "uuid": "242c8abd-044c-41a5-924f-44177b209f29", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617324519, "uuid": "f28288f7-c226-4b60-892a-36328c91c36f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617324519, "uuid": "41024960-5e76-435d-a56c-6be560969931", "value": "d483cc18a2af224b7e647857fa49006a66d640b961579f8a9f5ddc5dcd3c8a0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb193d8-9405-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617403874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617403874, "uuid": "2fde89e3-8df4-48be-bbd6-b07d8d1d282e", "comment": "Malware payload (Dridex)", "value": "b3a019f57dd1b70b467bdda5369b8e52", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617403874, "uuid": "59c27d00-5dcc-4c10-ba6f-46bc54dd7c4b", "comment": "Malware payload (Dridex)", "value": "d5757ecae8c3533bb72c61389bbdcf3cf9f4f6dfb7fdc71f989ae41f0fbaf33c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617403874, "uuid": "1eabd839-40eb-4a82-810b-629d301785b0", "comment": "Malware payload (Dridex)", "value": "79e36921e386afe2fe06b722e936d8a8d4d47d0e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617403874, "uuid": "20978a85-cb13-4f16-872d-1c76d40b755b", "comment": "Malware payload (Dridex)", "value": "15783929868c99eb7b1b9bb39acf97ecfae955dddfc08f2e674c088ffc97dfb761eac42340f4a18cd264b06a4fc2e23a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617403874, "uuid": "2581216d-891a-41d7-b6e1-dc2406576d28", "value": "27248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617403874, "uuid": "09e47e5f-6985-40f8-a365-499cdc9b25fd", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617403874, "uuid": "29110cd5-0bca-469f-b868-b9eb0c91e2f6", "value": "3072:v6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:voMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617403874, "uuid": "db7c22a8-e395-41a3-9100-75b121a72a5a", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617403874, "uuid": "1dcb67e3-f9b6-4968-b1ce-6b3177798ee4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617403874, "uuid": "0fec6f4d-7dc7-47c4-b9e6-a15e6d26c916", "value": "d5757ecae8c3533bb72c61389bbdcf3cf9f4f6dfb7fdc71f989ae41f0fbaf33c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ebdb24-9378-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617343200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617343200, "uuid": "704d0df7-fd5f-493b-910a-24db27c5fff7", "comment": "Malware payload (Dridex)", "value": "c1b8222d7889fb1b2ee9baf14aa2f23f", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617343200, "uuid": "95d7e0f5-40b0-45dc-bd65-bb1bdef32a07", "comment": "Malware payload (Dridex)", "value": "d6fd6b204847f1ba6e9e9223ab48a1252c5021afe826438442838b22ad4140be", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617343200, "uuid": "6fca9e51-3f3b-49f0-9adb-5fa29a679d1c", "comment": "Malware payload (Dridex)", "value": "f68e0cbdd2b135cbb62fb12dfe0a7496da82afce", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617343200, "uuid": "272b8fe6-d7e5-4133-8fe5-2d9fd4dd3fa6", "comment": "Malware payload (Dridex)", "value": "bdf9be2621e6bc6adcea00f2c7ae00a888fd24e440a1273accd648393bbc8e0016db0cc4263ea7f254bec8dafaee48da", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617343200, "uuid": "e2abfc27-d4ea-47f0-accc-db536b4fe9a1", "value": "2314BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617343200, "uuid": "1e66b9d6-2f20-486b-bf08-a64842598b03", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617343200, "uuid": "f7d12fa0-7c0c-4603-b42e-f61a83257344", "value": "3072:copj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:jpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617343200, "uuid": "8f29928e-188c-4f56-9b85-e19584267745", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617343200, "uuid": "0525e24e-c613-4e8f-8ec2-83482b1cf452", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617343200, "uuid": "83212d46-d68b-46a7-b118-9b51e32424f9", "value": "d6fd6b204847f1ba6e9e9223ab48a1252c5021afe826438442838b22ad4140be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6f9e01-937e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617345680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345680, "uuid": "a9242bc9-fbc6-4a5a-b946-e3b950c4bf22", "comment": "Malware payload (Dridex)", "value": "ab450a073b47b162d93969efff71ae38", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345680, "uuid": "82131b1c-726e-4516-bd37-dff39634f7ea", "comment": "Malware payload (Dridex)", "value": "d70d2601713cb58eb6879a81f9ec4f2ae5e03011ab44420569371c277918d287", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345680, "uuid": "4586cc74-0aec-4704-888f-87fa45cbf0c7", "comment": "Malware payload (Dridex)", "value": "79ac63f59d383d924ac12e07bf79f661b5304dde", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617345680, "uuid": "1dd5ab57-4479-44d6-b8c5-b74356cadb87", "comment": "Malware payload (Dridex)", "value": "936ec6fefd411353ddc8c63877ae03682761fea433fafaa7670a503cbc680a122a0cc9ae9b67f37eae24dd43fd273446", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345680, "uuid": "9ac1d220-cac1-4558-94d3-c2aac7d77be4", "value": "0F248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345680, "uuid": "4176635a-279b-42a9-b8cb-218093697b9d", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345680, "uuid": "dee3f042-d35e-4154-bf46-a62ed7637068", "value": "3072:i6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:ioMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617345680, "uuid": "383e0216-a80e-4d65-90a1-0d56bb094450", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617345680, "uuid": "ec533b17-2a51-44ab-b14b-60df6a5c2fff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617345680, "uuid": "6e3ca02e-bf3d-4b64-a913-de3c495aa769", "value": "d70d2601713cb58eb6879a81f9ec4f2ae5e03011ab44420569371c277918d287", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fad55fb-93e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617388282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388282, "uuid": "aa8570e5-f90f-4316-b79d-f49ac41c8f43", "comment": "Malware payload (SnakeKeylogger)", "value": "93893004ce88bce9360a575940369159", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388282, "uuid": "1bfd6628-dd1c-4b78-a3cb-38cddfae7b78", "comment": "Malware payload (SnakeKeylogger)", "value": "d976f1b0d4d1efb1bb69356d57fd8b19ed43883017480251d6a96258964e922d", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388282, "uuid": "95798734-8c62-44b3-80db-472140d6ef27", "comment": "Malware payload (SnakeKeylogger)", "value": "d4af092b4485009f810efe8c3bcbadb8cd2527bd", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388282, "uuid": "60c0e010-8be3-4358-97f9-e198e5605fe3", "comment": "Malware payload (SnakeKeylogger)", "value": "c57cde388a7eeee1c802377e361a9421752d58d2937277642a9af58a216a15ca4b21ba4ff9dae76af03f798313193765", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388282, "uuid": "7a9f6d74-7e89-415f-9966-6cc676d71ca4", "value": "63F4D3A870AE405DEEB46734F5B595821FC925321F62FF3F28E657005CA3B29FA4E910", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388282, "uuid": "3bf5b1a1-7b29-46e7-9419-35da7558e5f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388282, "uuid": "3b7c2e4c-3deb-4fb7-9b41-869bc149c511", "value": "12288:M7Ep5Kd/jb11/AEEM10c5NhL7z6XfaY4wuupzyo7UhOWWpsBkEov:xp0jRmET5NhLzCZxnwM9NEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617388282, "uuid": "ba26f78c-c331-47e1-a587-025345c9c1a3", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617388282, "uuid": "6a8b1b36-adf0-4728-acd5-8f0dcfb6ead7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388282, "uuid": "0dd9e127-596f-460b-8ee6-61cbf3cfefa3", "value": "PO - 12619.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb430564-93de-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617387039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387039, "uuid": "f3e869ff-4781-45bf-98ed-86b8c25588b7", "comment": "Malware payload (RedLineStealer)", "value": "a2d27ac7beaf46c0b35ed660ece256b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387039, "uuid": "666746bf-1752-446c-8e67-3bfb0f353f4b", "comment": "Malware payload (RedLineStealer)", "value": "da5f87ea1b0e0f4307378a7f4d7fe7077447be8123d9230d2a706bff4029c5a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387039, "uuid": "3224cbcf-dfab-41b5-a384-40c3f4c6f796", "comment": "Malware payload (RedLineStealer)", "value": "4a5c7508ef417df76dbc6d69f3a8d3da951305c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387039, "uuid": "e37ba086-6ab2-4c0e-8c24-463013231959", "comment": "Malware payload (RedLineStealer)", "value": "ddc5c5d22b0e6a3193bfa41ba881e1c8e56902f8f1c53bffae398894dc61621260b3e1d4644d81f5cb5ebfbbf5457119", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387039, "uuid": "81518c44-6abb-4075-85f6-69c170f4a98b", "value": "CE64F11171C4C873E5620A3444A9CAB1463AFC725F758AC7BBC42B3E5E267D18E3B786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387039, "uuid": "bdea1c06-d91f-4e4a-b12e-4f8d9f0f4c50", "value": "0e71c93ad51122945779f4479efb70a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387039, "uuid": "d4ed686d-e8bb-4b4c-bb75-6bbbda089ea4", "value": "6144:oF4W7IKvAUEoXmptaYXAAGO7XTokEGpzP8J6iPpmm9RlriUY9Cph:LW7jEoXSaMhXogdSbri+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617387039, "uuid": "f4fece61-98f8-4748-8b72-383e97484748", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617387039, "uuid": "8b426d1e-64de-47d1-b6c9-76a422df9a70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387039, "uuid": "4a008fa7-2c33-483e-83e9-88c3dea0ee62", "value": "a2d27ac7beaf46c0b35ed660ece256b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0351dd7-937f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617346326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346326, "uuid": "9f944869-1b7c-4fd6-8eee-960b498adcb3", "comment": "Malware payload (Dridex)", "value": "7751c53c7ae1c80fa1ce9dc69fdab56e", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346326, "uuid": "73ecc229-c876-456c-bd54-6680a71b1ae5", "comment": "Malware payload (Dridex)", "value": "da6819a8c38e700fb570d2b730f5bfd9179ecd692c1808d979db62c935d6882f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346326, "uuid": "53f96725-4d6e-4f78-bb49-ea7202f4cb97", "comment": "Malware payload (Dridex)", "value": "2e3257d770d90b001dfd7851d2ac1f10685e02b7", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617346326, "uuid": "082a4dc1-316b-456f-b18f-b1f5fce868ea", "comment": "Malware payload (Dridex)", "value": "901d8dae06d657e26c91823b3fa67109558ccf531ad7c3059777d2961a00e51e8826fc7b61900fb2feb60697e3dcae3a", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346326, "uuid": "aa1fed7f-1789-4669-9d2f-978168d00177", "value": "2414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346326, "uuid": "d03d901a-6ae8-40fd-862c-83a139d0906b", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346326, "uuid": "60a6821a-426d-4349-844d-748e4d3eeedf", "value": "3072:zopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:0pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617346326, "uuid": "e7f4b97e-4f77-48c4-badb-8fb4e05e873e", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617346326, "uuid": "5ec0ff24-baba-4a37-8469-c6eaed7b7cd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617346326, "uuid": "7baa497f-c289-41c7-80c2-306255c42718", "value": "da6819a8c38e700fb570d2b730f5bfd9179ecd692c1808d979db62c935d6882f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16d0488-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617386674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386674, "uuid": "6d5f28bb-8ae5-4882-a15b-1834cb3f7e00", "comment": "Malware payload (AgentTesla)", "value": "98c097a1e99b58f7a7920af90c577aa5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386674, "uuid": "365aa94b-f3e1-42c7-b44a-1886df025f9f", "comment": "Malware payload (AgentTesla)", "value": "da8a456df5097cd97cedcaae60d09a5b6688c58bdc5ec43043372667a881b4b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386674, "uuid": "8c286601-7c89-42e6-b637-3327074c7b01", "comment": "Malware payload (AgentTesla)", "value": "58c5df3d1e81e4959dd6033dfc2184be78e1f8e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386674, "uuid": "626d15a0-b52b-409c-b604-b0e808871a4c", "comment": "Malware payload (AgentTesla)", "value": "b4c3558ddd213440680c1eedd7e178beffe88e16fa6200ad59a44016d9f86c83eacc7ef8041dd7f15d872dfcf88fbc84", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386674, "uuid": "b4c837a5-3eb1-4e39-a6bd-cdb216de9a3a", "value": "0D25AD293F60658CC4AB1B395828D00C5FE67CA9A9D3C2837EEA37DB6477F1307A4552", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386674, "uuid": "c4eadf93-ad17-448d-b1f1-540af6893c8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386674, "uuid": "5314614b-2200-4bd6-9ee5-ef41d49d76bb", "value": "12288:OZpYZpSZXLDZHvVjFQcR90/daBnJm8rR9H7+vd+ShWRZ:OZpYZpOBtjFQcR9qdM5rR9b+vd+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386674, "uuid": "2c0abe34-6ad5-41ec-a332-d828f75ede8d", "value": 1053184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386674, "uuid": "9ad5665a-bb52-449c-b5d3-ac6d54e219bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386674, "uuid": "1b0f68df-283f-4bea-a5cc-3090405c4602", "value": "v3vcDo4xpfjF61k.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc365753-93b1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617367740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367740, "uuid": "963417b2-e600-40f5-96a4-8b8a240148db", "comment": "Malware payload", "value": "1b413140b86737345f12035eb8e7a9ab", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367740, "uuid": "a50dbad2-5ab2-49e5-bc59-b918a17e769c", "comment": "Malware payload", "value": "db4eaaabdebbcfc8e1820648a43f8505e6ea54bb6f631a4b63128b8fb1c92683", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367740, "uuid": "095959ab-95ae-4b31-829d-b45b6b3f7266", "comment": "Malware payload", "value": "23acfd8b7ca8ca0ecb75e3e25c3a48fc40a3c22e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617367740, "uuid": "f7f0d4f5-430d-4650-8bc5-c10df3ebdd96", "comment": "Malware payload", "value": "99d2ce24a2ccab6144669e3a0b597b6a0656dce7170796c0a7955568e6f577123a2d89ee3bc4f49ee4ed978e67d9c28d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367740, "uuid": "6ee76839-b537-48c7-bb9b-a1f020e24c04", "value": "6A04123CD0274C58C2E5447BD858C246AC6A2427ADF8A5ED668CB994EA137F30F7FB44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367740, "uuid": "a2609204-6ff5-472b-b8d6-bc717c8f7e0f", "value": "3072:dXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGDKJj:hE5SDvbXAyHbVt15wTQD0KJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617367740, "uuid": "8796fcaf-cda3-4dc6-bbc6-46cdf7c7b129", "value": 176993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617367740, "uuid": "0d77e097-f0a0-4345-af20-7cfc10ea04bd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617367740, "uuid": "1e64eb97-db10-4aca-9151-12ca2127c704", "value": "91844756223-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5818f17f-93a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617360244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360244, "uuid": "6c9ce186-90b5-4f4f-9a64-839acafc6814", "comment": "Malware payload (Dridex)", "value": "8597947b51b5465103f5f6532e57522d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360244, "uuid": "a1615ef7-3df6-4d98-9f56-f43bbd6e5aad", "comment": "Malware payload (Dridex)", "value": "dbe74f4c13b43399af7280d68eff906a45a73bead92de3dc01454a7b827c33a4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360244, "uuid": "cfed32f7-af9c-4e7b-9963-c12da98b75fb", "comment": "Malware payload (Dridex)", "value": "63bbdb8cd52c99454d105dcb6392b07fb22583da", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360244, "uuid": "d3149400-f150-456f-b179-8696b4c438aa", "comment": "Malware payload (Dridex)", "value": "15b0e3595019a28b515fe8928d34368aaac744a918fdd1c9abbf26fa3f69ad383fd2c91f27d82792ea2030da85fa1485", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360244, "uuid": "d24f457b-b70c-42a0-9fc3-9213b1022d0c", "value": "8A248C5FE339E486FEE3CAF54186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360244, "uuid": "f889e4e3-09e6-4966-bf46-09b72a7363c9", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360244, "uuid": "7b394985-b97d-4705-85aa-c6925f377736", "value": "3072:c6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:coMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617360244, "uuid": "67809346-7685-4183-b3c3-53c8cabdfe67", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617360244, "uuid": "619a2abc-d63c-4b69-9072-c189df777dc9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360244, "uuid": "8f15d2c6-4fb7-4f88-979b-ec4c86fb39f3", "value": "dbe74f4c13b43399af7280d68eff906a45a73bead92de3dc01454a7b827c33a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591f7056-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617386445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386445, "uuid": "3d43889e-975a-4b98-8894-ab9fec1adf2c", "comment": "Malware payload (IcedID)", "value": "111164a7d546c11205c71fa43b295cfb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386445, "uuid": "e0aa6693-0f9b-41b9-aa26-90ca27e2c629", "comment": "Malware payload (IcedID)", "value": "dc048747364363f28594a225a509e558458d954baafc89a8dd1e5cdb92f0a3a2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386445, "uuid": "108eb81a-ec07-4a78-990e-7b0205f6621f", "comment": "Malware payload (IcedID)", "value": "20d615c764a084263e1fba533a31396ef4dc8209", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386445, "uuid": "465e2fe7-f50b-4008-aaea-f1f984f007ef", "comment": "Malware payload (IcedID)", "value": "8e2de807570cada7725c50c7e3821afa7858ff6effe4cc8ec0f799d5e9d42692e0b671f7f1be799e4bb809b1aaa3446e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386445, "uuid": "34e8635a-480c-4426-acf8-24c94e45a988", "value": "D3530A8947503C91C0FEBD34F3A69A58931EFB30AA8F47B794C46BBAC47B5409723619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386445, "uuid": "a4f3e01f-58eb-42c6-b58c-139a4037e78c", "value": "eb10ff98c4adb7472a591c82bd2ff673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386445, "uuid": "4175878d-d754-4886-92f8-28940f3b4859", "value": "1536:caCAzXz8T6rLXah8lI+Idu+B3XbuF6dRiF:n/gTkXayetu+BbuUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386445, "uuid": "4da00ea1-5150-4223-96e4-9dc6619fdf47", "value": 65568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386445, "uuid": "228ff57e-3f88-447d-8849-c2c748e70a5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386445, "uuid": "d0589a3f-44e7-430b-9d73-bcfd04cce8b1", "value": "dc048747364363f28594a225a509e558458d954baafc8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "705be992-9366-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617335374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617335374, "uuid": "49ee3a29-79b6-4a3c-b6da-d5d564205b3b", "comment": "Malware payload (Dridex)", "value": "4569a75b4165c9b9bba18945c2595fad", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617335374, "uuid": "7c57d229-8bc0-42ca-b153-58eaf96e9428", "comment": "Malware payload (Dridex)", "value": "dc3102b60c9ded5fd9dca2dccbf6a0819aa9ee3d2725e5d597b0d2985878f1d8", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617335374, "uuid": "ba45533a-91ca-4246-9ec5-6b01cf9b27eb", "comment": "Malware payload (Dridex)", "value": "93b408d880f993840d4f90f43db8108309f94424", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617335374, "uuid": "95889664-2655-43ff-badf-b8bb1bf246cf", "comment": "Malware payload (Dridex)", "value": "32b5bf4ea6d284b4665a69847de16cd312553a2caa65a81434fb5305c69c300bbe27f579aaaa44411cefcf1a2834344d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617335374, "uuid": "9eb499e3-4c26-42d7-b43c-40fe206012f5", "value": "8714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617335374, "uuid": "9605704c-0c55-4789-a166-1d66382a2e7e", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617335374, "uuid": "3cef9e26-e2bb-4ca9-ad6f-6733abb9f255", "value": "3072:ropj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:8pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617335374, "uuid": "8141270f-6093-441f-b276-89d9c787bdf6", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617335374, "uuid": "adf35a18-503d-401a-9c9b-e07a183a7c0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617335374, "uuid": "fbd1255b-fee9-46ce-814a-1eeff1b2710c", "value": "dc3102b60c9ded5fd9dca2dccbf6a0819aa9ee3d2725e5d597b0d2985878f1d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ffdc85-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617386546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386546, "uuid": "14f7ad65-cdb3-4455-b105-5edf838c7805", "comment": "Malware payload (AgentTesla)", "value": "17b5a1729899fe201bb5fbab49389e93", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386546, "uuid": "fd8d3c37-71df-4283-89d6-bbb80e7f3646", "comment": "Malware payload (AgentTesla)", "value": "dcb9a8292fc9f0c8e21619f670b9d4d21127e09fa470fe0b201d41e4d3166eac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386546, "uuid": "08543443-462f-4671-8618-d4522e701b77", "comment": "Malware payload (AgentTesla)", "value": "206792e0a46ddfeb8d02e973438ef5a0ed68d9a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386546, "uuid": "d17be8f0-c35b-42db-8c70-58f466bc6903", "comment": "Malware payload (AgentTesla)", "value": "231d1c52f57c77bcad09642340911779d6d093866e5bf9c25c09ffbba580528167d3739c098f39ef777a4d08506cceda", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386546, "uuid": "df9b1bf1-e9c6-4f74-b93e-df17ac56bb39", "value": "3FF46A6337437BAFED7853B22442400036F16D2AE3AAE55CAC95334C4F772C19B9E666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386546, "uuid": "47e5b234-7f52-4bf1-92df-c527ea1643a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386546, "uuid": "dc6f02f7-45df-49a2-9a5a-e08e18d5b643", "value": "12288:GL8876jao3/ZWNieGjTd/rLbEZZWAimRjH1OceZ+GeJ/+Ub8ZY:GSvBWNi7rkZ1imRjVOceE/+xZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386546, "uuid": "2f9c79e6-8879-487c-9f53-6287c511ae5b", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386546, "uuid": "84d61eb9-2889-4aee-8215-04037fd99cf9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386546, "uuid": "4a8ffda0-e817-4d74-92dc-74f1f36d644c", "value": "FedEx delivery document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493fbb92-93b4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617368809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368809, "uuid": "e4abb3c2-736e-44b2-8872-10c7c297264e", "comment": "Malware payload", "value": "cde4a39654342846fd940d0026cac5d5", "object_relation": "md5", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368809, "uuid": "cbe0e879-84c2-4d35-b585-659400e40c63", "comment": "Malware payload", "value": "dcca56dad3f0113326e3c2c025fb8c9c60721c81b5af8b7821969c7673307de9", "object_relation": "sha256", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368809, "uuid": "3f8b82de-7186-4ce1-a5e0-2452cf0485dd", "comment": "Malware payload", "value": "4891e15a5fe5987b5a46a72ff59803571434fd58", "object_relation": "sha1", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368809, "uuid": "3499ef39-045a-43bd-a2a3-0a8a42ae2819", "comment": "Malware payload", "value": "b1a712cfe03e20e0392af3e8d7aae60d057bf671d6f345fa17e31fd33fa1e32a0d9067c1dae921c7340800f356407415", "object_relation": "sha3-384", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368809, "uuid": "4a339b7d-7754-4378-94ba-52357c06facf", "value": "5AF44B163A4CDD01C1BA1637D9DF85188BFCE941BA62D71A7D9A33DCA4513A32D0F1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368809, "uuid": "c60b5821-f3b4-47f8-a69e-b14b4317ee38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368809, "uuid": "5e44876c-600c-4297-91d7-f9ee47f42838", "value": "12288:RK66+esTbjwgSmMVl4erSg2FBEygG6NUUfteqWtvvNnOdmqn:RK4TIIMVrt8BEysXteqWBd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617368809, "uuid": "f1651d0d-942e-4adb-8d1a-3d990f0ceb65", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617368809, "uuid": "da62f87a-70f0-4fc7-a79d-18b5a86cb45c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368809, "uuid": "d77ada90-2809-47fa-acbc-b318136a432e", "value": "RuntimenetcommonReviewsaves.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e257182-93da-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617385246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617385246, "uuid": "ad39fe9f-3b5d-4cac-837b-aaddf884312b", "comment": "Malware payload (IcedID)", "value": "df0f8660829f76883940aa0ada5cf72a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617385246, "uuid": "1c1d035a-abee-47b2-af96-cbf01d710c94", "comment": "Malware payload (IcedID)", "value": "dd224e10855c12047cf8fd4944fbd0de2c9bde45d58366a6757c1b25f156cea7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617385246, "uuid": "7a8892cd-543a-41d8-8cb2-219b343081a9", "comment": "Malware payload (IcedID)", "value": "a014cb8d6303b5920565f615174c10809430b4a3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617385246, "uuid": "b9bcb59d-5857-4436-a78d-ec706f9280af", "comment": "Malware payload (IcedID)", "value": "376919cdde803e984aa70a5aba859517c7163500b61cc3f400146228ac71b484fc316fdcabf01926391277f2fb6ff655", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617385246, "uuid": "18331816-8173-476c-b9df-8db3ce934aef", "value": "68530A8947503C91C0FEBD34F3A69A58931EFB30AA8F47B794C46BBAC47B5409723619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617385246, "uuid": "88b5bc2d-93b0-47c7-8767-cf8197a8d215", "value": "eb10ff98c4adb7472a591c82bd2ff673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617385246, "uuid": "6902907f-b117-469a-adca-a0e0620717cf", "value": "1536:caCAzXz8T6rLXah8lI+Idu+B3XbuF6dRiF:n/gTkXayetu+BbuUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617385246, "uuid": "30073815-bdec-4dea-840f-071c927cfe9f", "value": 65568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617385246, "uuid": "498e81b6-f983-40ca-afa3-e741cb568e88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617385246, "uuid": "94fa0e57-9b31-47b8-86f7-ed96a9764cd1", "value": "dd224e10855c12047cf8fd4944fbd0de2c9bde45d5836.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c525953b-938f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617353126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353126, "uuid": "4e6a193b-6af4-4385-a444-e6b1ec4f897c", "comment": "Malware payload (IcedID)", "value": "3d2534b5efedfd514711aa8ce4145abd", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353126, "uuid": "0120806b-2f0d-4f82-83d3-35f14cc06bf6", "comment": "Malware payload (IcedID)", "value": "ddc7634ada0c96bd0ddb26af929449ba141713f71b276c498ec049e944a1170a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353126, "uuid": "54130962-81fe-43cf-938f-984ff2392493", "comment": "Malware payload (IcedID)", "value": "1626ff37c633ecd2701d481d05f651ddf45e167e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617353126, "uuid": "93be4377-6d15-4cd3-baf3-2cd8ea786a48", "comment": "Malware payload (IcedID)", "value": "b75f634501c3f23f2001d9b268e2e73662b1e0e46f1db78b348543d3f09b1e9302fce84642cf4e18ef7fe1273ffdd286", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353126, "uuid": "206c5dab-507d-401e-94dc-6248d38cd42c", "value": "4C838CCDC913E1D9C2559FBD5A0A308112F4E0B7276FF11B148EA62E0D42FA90A5E79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353126, "uuid": "7a312946-da13-49bc-8a83-24b7a1a746fc", "value": "1536:IB240XZfcaaxf+EQliU2haw8CAIoo8+BNvMhfvPv:+2d1cBWEQXM89o8+nEhHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617353126, "uuid": "6da99bc7-7083-4cb9-b3ef-b14668fe8840", "value": 86232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617353126, "uuid": "01a7fa4d-d91a-4efd-bf53-3e1b7c28b61c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617353126, "uuid": "fe5806aa-c417-4b7c-9ca1-604c34f43b67", "value": "1623.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1e725b-9399-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617357429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357429, "uuid": "166dd7d0-ba30-4cf1-82df-fa5932e4c487", "comment": "Malware payload (AgentTesla)", "value": "82a9b9bf1ccca7bf7650e08460f1b90d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357429, "uuid": "a16eb798-d3ac-461b-80f2-fb31ccd43d25", "comment": "Malware payload (AgentTesla)", "value": "de4692d7b90364891dd45a8356b219c16725e00aa92c824cbfc33a9c4e31cb16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357429, "uuid": "a3944b8c-6de5-4fef-972b-2bde15849eba", "comment": "Malware payload (AgentTesla)", "value": "2f442122a2c08826a7059ce87779d7333dc880a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357429, "uuid": "536ca45b-ecd8-4ee9-8a08-0462442ce451", "comment": "Malware payload (AgentTesla)", "value": "6ed3bb69b148437f3e0ad00663cbc610af4db277336375c5177baf9fc44aadce68cbefb7f4140665c06444af4b5bda24", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357429, "uuid": "984cf3c5-69f1-4f52-bd23-2f12cc5e5f0d", "value": "4CF4234B522ECEBC5647443886B84AD042E3AD84D8C6DDCEA6D685C2D9FEBF7950031F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357429, "uuid": "d99ccd17-33ff-4f86-8011-00282a4bc73d", "value": "12288:vIXyio5ak2ll63GNIFRTSaWy/1WGqj8FlyzNcW/jeyIH5hq/jd6n1:G4ak2vGGNATSad/1W9AINhH7d6n1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617357429, "uuid": "f7427892-e3d0-4b7c-a021-cb89acf6376f", "value": 778495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617357429, "uuid": "29a459ae-445d-42f0-b28e-011b408447d8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357429, "uuid": "143a1003-ec5c-42ec-af25-74ad7ca931fc", "value": "QUATATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfb5e7c-93de-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617386881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386881, "uuid": "63cab349-b549-411f-897a-ff9d84540947", "comment": "Malware payload (Gozi)", "value": "741e6ef2d68033ee0c03472f1aaaf0c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386881, "uuid": "54c60b04-1788-449f-b097-5ed7dfbf389b", "comment": "Malware payload (Gozi)", "value": "def873123cd2f2a1a2bb661c1ea1986526b86240fb4263e96be6c6a528c02428", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386881, "uuid": "5202c9ec-541b-4833-ae8e-b0260c04da2e", "comment": "Malware payload (Gozi)", "value": "f5732ab57b7bdecc26a1bd75004fa53f4c1d59a6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386881, "uuid": "f4aed45d-7e2b-4e9c-ab76-a49e52709cf4", "comment": "Malware payload (Gozi)", "value": "ad6e01fc64aab663812da64201c8aeaa198b77ee98d8117b74a5ee80689cd97acf9e36449cc3696697b8dbb9e3d6bd47", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386881, "uuid": "7f4048c0-9f1a-4dec-b705-c7a19e4d4366", "value": "1DB3DF00B9DCC4C1D3EA99B049A4DE75350AEDA62834900733F37F6D7EF63A629AB544", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386881, "uuid": "51de4a59-8bd7-47d6-91ee-bb9c164a89dc", "value": "811de8e945c2087a6e052096546cd842", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386881, "uuid": "1949d772-3d50-4599-bf40-d7018b4c0530", "value": "1536:DWKaY5Se9WnVI78XvnoxJasJvRHKmyGDvDk0Rt9Y56l5ZMpvV05o9OX5xPw8:DWa0eQnVI7qCqZGDvDk4wol5w0EU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386881, "uuid": "3379979c-eba2-4333-9e4d-f184e98d09cc", "value": 108458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386881, "uuid": "60df2c09-f642-4902-bef4-f1aea0d1c340", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386881, "uuid": "b5afd2ce-c6b7-48d0-b9e1-2453cae87a8f", "value": "741e6ef2d68033ee0c03472f1aaaf0c8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d105ff8c-93b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617368608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368608, "uuid": "8e94647a-cb32-4abc-8c23-ef3575249f13", "comment": "Malware payload (Dridex)", "value": "5323257ee0eaf7c32aebdcd0dfc80db2", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368608, "uuid": "cf5dcb0d-2e75-4799-91f6-1562011b0c67", "comment": "Malware payload (Dridex)", "value": "dfb1b47a6ceb378f754278d78a2d77ebb2ebcbe01875430a9b8e9fa5e4306137", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368608, "uuid": "9a38b943-5b6f-479c-8c86-122a633fc3c0", "comment": "Malware payload (Dridex)", "value": "bc2737af03f9e91d86f283bed9e8b2f6efe1de08", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368608, "uuid": "cdf8ae46-1a03-43ff-be83-8c98cde5451b", "comment": "Malware payload (Dridex)", "value": "1be97c1402d9a686ee9437f49628c8da6e28556f0511f6dbf5ac592dfc5b41d43a64beaa045a931f430ba78d54a97547", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368608, "uuid": "09b7f799-a70b-4aec-8d6c-c863ea55eeca", "value": "8B14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368608, "uuid": "37b34a83-185f-4fa1-a4c7-765016c8b7bf", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368608, "uuid": "d6bb6205-fc41-4a36-b320-af3ab6c8b5c3", "value": "3072:xopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:GpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617368608, "uuid": "8418884c-633b-4cc4-88bc-d65594a69902", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617368608, "uuid": "655c8835-ad19-4d39-88fb-29ab3114ef12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368608, "uuid": "b15559ff-a6ae-47b4-8b62-3956685fc062", "value": "dfb1b47a6ceb378f754278d78a2d77ebb2ebcbe01875430a9b8e9fa5e4306137", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cdcea18-93b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617368788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368788, "uuid": "61c3bdaa-1854-4e1b-8e1d-18ef9928b83c", "comment": "Malware payload (AgentTesla)", "value": "54e1c49229ea61c5cc22af680d63a8fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368788, "uuid": "ebb37f12-6964-4534-bee0-b20ea36fe8b8", "comment": "Malware payload (AgentTesla)", "value": "e0b089624aa744f4dce1b1d77eb91d0d404b10b8ceae2f1fb6bf08f6f3be1bb3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368788, "uuid": "7511a430-8fe7-492f-8495-b46c0511b2df", "comment": "Malware payload (AgentTesla)", "value": "3667c08960a5d4192da97141ee872a66ccbd18f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368788, "uuid": "36ded9f0-64c1-435a-ad36-179b6c4f1d74", "comment": "Malware payload (AgentTesla)", "value": "34edb5e1535d4bdcaa032539a311a7316a5062f5a204f31f1d83e5c7316cc699db3421953a10aecbd64cfdddf3d212be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368788, "uuid": "7a86f54a-af8c-41b1-911e-38e113961015", "value": "31F4CF303388BBA6C43E67394824524053F2B95AE716DB6F7CD8219E2D62F478336B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368788, "uuid": "3f013b8a-9df4-4a44-af84-fafad0eb34f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368788, "uuid": "b9f6192b-3288-4f93-addb-4bb7391de3b0", "value": "12288:eZ43lOWp6MaTiFMmegx8pcVikLHlihs/O11:e6Jp6MUmD3D02/O11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617368788, "uuid": "680f6c03-ae42-4bce-bd99-2c7594b4b16c", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617368788, "uuid": "7324a790-2007-4c01-98cd-06113c93da02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368788, "uuid": "89ce2dce-e1a2-4390-96eb-f385549c7721", "value": "25841.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76300cc-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617386711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386711, "uuid": "f4323ed0-9dbb-407c-923d-699db7806703", "comment": "Malware payload", "value": "473a5b612e66f24f458cd6b3c4924352", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386711, "uuid": "8d31e294-a7ad-4e00-8644-ea7e4453f9f8", "comment": "Malware payload", "value": "e1085bcdc764824455c6ab055204c82a4d54f8e637d24102acc6b4107a3b84fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386711, "uuid": "7bffb481-fd87-4a11-8965-36bd50491e2b", "comment": "Malware payload", "value": "3bb3dfa829bf223d6654d3808a3a889c8ad0c74b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386711, "uuid": "bc24ae43-832f-4eea-87da-b68efd32c997", "comment": "Malware payload", "value": "2cc82f6b1af316d03c2312e31cc44db4d9fe529e98074e7f56f750167e7c38b7ac4a15749437e3612386c75d31ef2b22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386711, "uuid": "a7ef7cc9-17e8-48ae-9647-e87010894ac3", "value": "3225F22BBB740519F0C241B1195469B75B3AAC3262969C0FF783AE1C14F2683F9F176B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386711, "uuid": "6c46e09b-6585-49bc-874f-2db73a273ecd", "value": "12288:VfXKDZ+P0rMoV1JsOs8tEDO7y8xL9WFoHLBVfeg/fXvf0JoAXtUrAWacPfXf1mY:xK4PWB/sf8iD78xgIvf0JICiN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386711, "uuid": "a93dbc0a-21ed-4083-a8de-fc4b5af00083", "value": 974535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386711, "uuid": "8ba409b3-50dc-49d2-af23-a432b95931f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386711, "uuid": "0fe08e3d-7f1a-4579-ada7-1c7beb1e9c49", "value": "473a5b612e66f24f458cd6b3c4924352.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b0487e-93e2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617388612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388612, "uuid": "84182387-7c18-4683-90c6-78f02eaf620b", "comment": "Malware payload (Dridex)", "value": "f2c5a917eeda3517da69c2149a364cc1", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388612, "uuid": "ec28979a-5ac1-4072-83af-ffacb540c52f", "comment": "Malware payload (Dridex)", "value": "e1262e33f0d3821ae2198fde15a0078782a7882d6c55d7a447d2e75082743549", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388612, "uuid": "8521ad38-0094-49fa-8d3a-390554b6bcdf", "comment": "Malware payload (Dridex)", "value": "8cdf0651630413a07c8204e94f40d93806a4a9ec", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617388612, "uuid": "fb9d05e8-0b07-419c-8e84-215e9b9b5c57", "comment": "Malware payload (Dridex)", "value": "37bb93827fb8811c802c4e2e02f5136513ab2ab8f8534df4e388e8eedb530bd677a0b74c6ba1d30e375b1a882173735d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388612, "uuid": "c846fe59-034a-42d0-907a-abfe6729c0bf", "value": "6014AE9DD729E464FAF3D9F104359A1210BB6C49892F914AEAE0A6FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388612, "uuid": "fdd2fa42-9d2b-4ddf-81ea-43d38195b082", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388612, "uuid": "79148b98-518a-4257-be9c-173a93b62a73", "value": "3072:O1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:mi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617388612, "uuid": "c4337718-eb7a-492d-8d4a-74a250acbbd1", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617388612, "uuid": "a19587fa-1044-43be-8bdc-6ace79eaf6dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617388612, "uuid": "81fa8f02-a314-485c-94b7-9cd5eddcb73f", "value": "e1262e33f0d3821ae2198fde15a0078782a7882d6c55d7a447d2e75082743549", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412663eb-93df-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617387264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387264, "uuid": "22a00aef-792f-476e-ab47-a8d9737d2fd7", "comment": "Malware payload (NanoCore)", "value": "8b7d9f4f98194d9c7dee496cd977cb1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387264, "uuid": "59e7923b-1ee6-47f0-bd61-483779edc1cd", "comment": "Malware payload (NanoCore)", "value": "e16534e401f929335635eb4f14afe32711a45b13e8e67b6a136294f3084e2221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387264, "uuid": "e57758d6-fb0f-4233-9f6e-02e8f4a63944", "comment": "Malware payload (NanoCore)", "value": "2ddc1a31dafc9ecb21406a7b73fd835d49614337", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387264, "uuid": "ade57590-a09b-42b3-aace-e024703a253c", "comment": "Malware payload (NanoCore)", "value": "dc70de8c6185447dad6eaae78b9578396f13f443c8bed766d44b7f68800507b981c20b9bd45794873bd33e33996f074b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387264, "uuid": "cd034251-5505-463d-a736-c57723c8b771", "value": "32E4A0A870AE005DEEB46734F5B595821FC925321F62FF3F28E657006CA3769FA4E910", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387264, "uuid": "2f252836-2295-404c-a20f-42574a589b30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387264, "uuid": "991c6cc2-5d76-4278-8114-7ad2ae49d342", "value": "12288:Es/+hTHTapHrf6PhrDqqT8n4Aez+5TJMupdY5YVpq/t72Kav:oz4rfsrpAxA2i5GqN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617387264, "uuid": "85001eaf-6948-43e7-bbd3-3d38e3a93182", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617387264, "uuid": "8e252162-b01d-4440-8aeb-795baea540c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387264, "uuid": "6e08d8a5-6664-481b-8d1f-0cbfb85127c3", "value": "8b7d9f4f98194d9c7dee496cd977cb1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85aedf56-93fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617400264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617400264, "uuid": "509f78d6-eccc-483f-a822-155dea573bf1", "comment": "Malware payload (Dridex)", "value": "6a38b17bd8cc22624d41a4565aa256d6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617400264, "uuid": "7b80ab31-a09f-43c1-967b-62d90b6f402b", "comment": "Malware payload (Dridex)", "value": "e1e23c3ad4d728c56ebc0edda54da8b0ae594f41e04bd04138b96118bb595ee7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617400264, "uuid": "6b34d806-addf-40c9-8a50-a643861770fc", "comment": "Malware payload (Dridex)", "value": "63ff060dcc3e038a59794e8a78fc70bc63bf606a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617400264, "uuid": "c083da58-cbd3-4f00-86ac-ad683693788c", "comment": "Malware payload (Dridex)", "value": "a9e3639a2d2a37e12e7e9ff1da08c1d67e2232aeddea13fbad227caab5878e2fdb9eaa0153a54066180da2e8addfb2e3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617400264, "uuid": "d455554c-0b55-4295-a868-9e1404c36c6b", "value": "24248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617400264, "uuid": "16ca2d4c-a64b-4a9b-bcca-3a5f18854eae", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617400264, "uuid": "178aac39-b268-4a7a-8fa5-0be5d70e7167", "value": "3072:u6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:uoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617400264, "uuid": "f3a594e0-fe80-45fd-a18e-cf09d6e1863d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617400264, "uuid": "1dd1864e-d6d5-4975-a773-fc7a21543aa3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617400264, "uuid": "505f0b01-beac-42a5-911c-8df969627ffa", "value": "e1e23c3ad4d728c56ebc0edda54da8b0ae594f41e04bd04138b96118bb595ee7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1732a3e-939b-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617358273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358273, "uuid": "8992ea77-b41e-4033-b86e-3738f4e6c081", "comment": "Malware payload (IcedID)", "value": "56105ca591ed4a0e20d3521638dd3bb4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358273, "uuid": "f31e1725-3c04-49ce-80c3-a6f0c5cfebe0", "comment": "Malware payload (IcedID)", "value": "e2280cc6179bf4519551422272210dbd818357391d59c1b524a8034e61504e90", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358273, "uuid": "2f6a847b-2371-4981-8a3b-42c31cd47859", "comment": "Malware payload (IcedID)", "value": "8ea949ba2a2130ffb2407fa95f9280ea423b0da8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358273, "uuid": "53befc05-a345-4753-a8db-40e6d5320f2d", "comment": "Malware payload (IcedID)", "value": "c05e1c3025321834338aa584419ff06fdca5daf09c0cd1871bdbe83d66817f35cad06e7f9760c549217345104057bb16", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358273, "uuid": "9440f216-b748-4b29-a38b-23cc2a25432c", "value": "CCC3298D6B907CA1C0FDBD34E3A19698821EFF309A4F47B794C5AB79C0AB5409623749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358273, "uuid": "e9861945-51ce-4258-a876-dbf3ad7cd25c", "value": "eb10ff98c4adb7472a591c82bd2ff673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358273, "uuid": "1946472d-c575-466c-8943-177e08a55d5a", "value": "1536:fmXIFRBSvf0EW6SL504jXnk1Nzva2Xj3108/l:dbafVsL504jXk1RvlXJdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617358273, "uuid": "850fd03b-7c2f-4a21-ac80-3eef7720e912", "value": 119311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617358273, "uuid": "eef68e44-ea1f-4560-96c4-f6f111300d25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358273, "uuid": "46462c96-9d85-4e33-9d3a-045dfa59f151", "value": "56105ca591ed4a0e20d3521638dd3bb4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4767103-9396-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617356185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356185, "uuid": "05b3a8b2-6b6e-46d9-b55c-c943f151523f", "comment": "Malware payload (RedLineStealer)", "value": "0529792dae6b31c11d0f200af105fb51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356185, "uuid": "33d1553f-7062-472d-8c33-84b6787d9c60", "comment": "Malware payload (RedLineStealer)", "value": "e2a3a134421c597d262a080f13c3bed0d7c8c605d8c6472bc8fc490e742ce44d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356185, "uuid": "9416e2f9-4077-41ee-86c6-35124e70c579", "comment": "Malware payload (RedLineStealer)", "value": "e18225ad7441e40ea312ebeb22b938fb451d38d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356185, "uuid": "7cb9d15e-6ef8-4616-92af-dce69b5bd7e2", "comment": "Malware payload (RedLineStealer)", "value": "d40699a46b4625698c2df615924c542039ac56f01617474416667c5a7b141b8e9594cf5925810172b99d5d2cf366b02d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356185, "uuid": "ce69c31a-6d87-4e0d-ab16-f6749d96b673", "value": "1264E011B5D5C433E6510A350875C6A50D39FCB6AF35ABC7BB843BAA5F362D18A32383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356185, "uuid": "bda9801e-398e-4928-8c69-006f65ef6e8e", "value": "ed7172c3c70bc3db63b13756ddc42c2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356185, "uuid": "0be0a24b-6808-4900-8e70-039f044aa513", "value": "6144:n8T0p416WTdwTuytFimz3bXKvqYkjFjfuch8pMIA2YbhoZXf5:w0p4BdwayPhzz4qYkxjfu9p9TZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617356185, "uuid": "97f0570c-bf60-4625-8e3f-af85d216f845", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617356185, "uuid": "f281e0fc-20c8-497b-ba7e-1543069113eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356185, "uuid": "b4baa53f-f921-430d-b4b2-bf0f8091acb0", "value": "0529792dae6b31c11d0f200af105fb51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26850b68-93b4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617368751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368751, "uuid": "6713af10-0972-478d-a57d-d469f7fd25cb", "comment": "Malware payload", "value": "13593849a4e09192db8265ab50f99629", "object_relation": "md5", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368751, "uuid": "4df5cb05-5f27-449b-8099-e0c215b99032", "comment": "Malware payload", "value": "e2c0f6c339713ba63202f13e1f788997d87b4d8ce38cb6bb8f214bc92020b77d", "object_relation": "sha256", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368751, "uuid": "ac657bfb-acef-4305-bbf6-2f925a6e8470", "comment": "Malware payload", "value": "77a24dc4821be47d9d8ff08a6ceb41bc279461a4", "object_relation": "sha1", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368751, "uuid": "6ea69ae8-67ee-4e85-b28b-0f85c2244f27", "comment": "Malware payload", "value": "91766e06925addd4c8a7e78596072f6cfc6b57bebb1079d97630dab0c3e318f0581c3bc65811db77bfa044200b361082", "object_relation": "sha3-384", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368751, "uuid": "b3e06576-3513-413d-b1d0-69ec4301e959", "value": "48357C217A48CD11E16A2236C5EFC6385BB8AD406723C71A7EDA7F6F78113936D0D1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368751, "uuid": "1803908a-e575-4a06-b3f4-418e393563f2", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368751, "uuid": "7bc7d8e3-50db-4ffd-a850-e6e67863e4ee", "value": "24576:e2G/nvxW3WSU0fH9Wo/1kbtcglY1zinSFXXtk37Z+E:ebA3xFFfmJctXtk37YE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617368751, "uuid": "dfa0550c-6ed5-46d5-8704-79793ec05cad", "value": 1163195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617368751, "uuid": "ea9cde3f-cc35-475a-bec9-99c5f35ef85e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368751, "uuid": "cf00e6ce-da8a-497c-ae6c-413028740e95", "value": "d.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c23d2a-93a6-11eb-abe1-42010a9c0039", "comment": "Malware payload (CobaltStrike)", "timestamp": 1617362713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362713, "uuid": "e8b128ce-bd8a-4c55-a18a-eeab478601c8", "comment": "Malware payload (CobaltStrike)", "value": "4a2cf7a487bc1be98239471f0f8f38e6", "object_relation": "md5", "Tag": [ { "name": "99.81.122.12", "colour": "#6905C0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362713, "uuid": "fdc86f4d-340c-4d1e-9e7f-6f7bb6c7f279", "comment": "Malware payload (CobaltStrike)", "value": "e2f3521c5e1aa540e4b6bdf1a630e942d7625e1347d84f2c7581828b3fa53e08", "object_relation": "sha256", "Tag": [ { "name": "99.81.122.12", "colour": "#6905C0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362713, "uuid": "ab0dbacd-c306-4444-b71f-55fbbd9cb899", "comment": "Malware payload (CobaltStrike)", "value": "b63ccb7f3cf9d726816cd01107a9bdd7f24fc4f1", "object_relation": "sha1", "Tag": [ { "name": "99.81.122.12", "colour": "#6905C0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362713, "uuid": "fa6b43fc-d999-48d4-ba8f-aad52361c631", "comment": "Malware payload (CobaltStrike)", "value": "5216553fcc42a452e9767be7111963142210aa0936b18c8ae8b101d2d9b9ff9f7a0f47beb2e7c0c5f801d84cacd3bf6d", "object_relation": "sha3-384", "Tag": [ { "name": "99.81.122.12", "colour": "#6905C0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362713, "uuid": "04c77c96-bac4-4205-8294-9e78b69f116c", "value": "C3B4E069F2D724ABCC8498F185B0BC2B585C15370C8D282FEF698C697925BD0F05F79A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362713, "uuid": "90705505-3ee8-4ba2-87a1-94e9be8e3a26", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362713, "uuid": "c2e81727-0c73-4423-9de3-fee259574ea1", "value": "6144:NVCDaMr20jzyWej17jnFCGR6RwGc6ZZVxLSu8qrs2W/E5DcMWDBvKt:bgaSPyBVoGcRwGc63Lh8qpt5vwByt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617362713, "uuid": "9a7f09e5-02da-479e-9c93-afa2e9269f2d", "value": 524800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617362713, "uuid": "12220ea1-c9b8-4dca-927a-d6cd1891568c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362713, "uuid": "34e79e40-9c87-4c20-8d26-dce5f38d4ef2", "value": "e2f3521c5e1aa540e4b6bdf1a630e942d7625e1347d84f2c7581828b3fa53e08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b352e53-937b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617344385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617344385, "uuid": "de9da899-d74a-4fc6-98b3-6ddb6a459209", "comment": "Malware payload (AgentTesla)", "value": "cc5b74558725157175dd98d94a844019", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617344385, "uuid": "fe8c8b83-154c-4499-b70f-9f7070f942e3", "comment": "Malware payload (AgentTesla)", "value": "e325425ca4750deedd77ec79dcb6ad6d258f79cfc72aab0dc4f71b735a997c1f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617344385, "uuid": "78688961-48c9-4133-a82e-41d8c269c4a5", "comment": "Malware payload (AgentTesla)", "value": "a123c3e77bfa9cfaeb3a64028d648648aee7d9d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617344385, "uuid": "c796a2a3-8d7a-495a-b50d-10ca74e8a1bb", "comment": "Malware payload (AgentTesla)", "value": "2523c887dda3033f9c309d86042d91bb3c6abd2e81d6be2c3443bc4fc56bd51ec9286eb2c5c1b048489f920baa71d0a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617344385, "uuid": "16811027-52e5-44be-8b52-f4e5e3842ff3", "value": "FF25AE293F54618CC0AB1B395868D00C9FE67D99A9D2C2837EEE37DB6473F1307A4652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617344385, "uuid": "e428e644-fdb0-4538-a3a2-544e0a1639d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617344385, "uuid": "2ccea0af-2f40-45ba-9ea5-3b314bbafc27", "value": "12288:107iKkjFLaoR0UnWTghlrqUQvP2jOWaD+x+gDthjZ:105GyhghlrfqPXWaD+x+gD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617344385, "uuid": "73c7a2c1-dec2-40c5-b71a-04099842ac60", "value": 1053184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617344385, "uuid": "7b9c98b8-9c40-4f36-8a9b-870efe5703d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617344385, "uuid": "88392f3b-076e-4072-b0d7-0265ae107384", "value": "bank receipt.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a7f867-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617386518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386518, "uuid": "238fa607-aa22-497c-ac37-cd02e1590ac1", "comment": "Malware payload (AgentTesla)", "value": "05d1313dcb7be4a8c663a12abd2b48c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386518, "uuid": "356e5c9f-fbdd-4540-9984-3322f70356ee", "comment": "Malware payload (AgentTesla)", "value": "e3dbf118d6c7df1ef21ad8935f4751dd7c64c40700f7d5e9db078f6c4bb28bdb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386518, "uuid": "08270242-34d1-4232-a333-05315e19d8cc", "comment": "Malware payload (AgentTesla)", "value": "d12e717ebdc9a65698ed67982c1eadb001ace23c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386518, "uuid": "4bc58adb-2f73-4fdb-ae94-9e57eaef3be2", "comment": "Malware payload (AgentTesla)", "value": "22ae4ed5835aca1a3b4931a7067bb8a029f2b6cd33a52991548fcac77a18dde829063536d4ad7741754e15cd4c7a33ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386518, "uuid": "64857388-70c3-478b-88f4-15798ccaad6e", "value": "6653C601B681DD12E1A59E320CEBD6EAB37A7D055E468217325C7F3F7F32A608A527C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386518, "uuid": "230da2f3-28c0-45d5-896b-67aef7f6dee1", "value": "384:bKKKCgKwqr2xTZ+ShKLeWHdceVfS+rZotRIiDWBDuZEi6siSY5U5XvradNwtg/d4:TYF++bWHdcs76smBJaA/TT0P9WlWTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386518, "uuid": "f9b86e31-29fd-4c1f-9635-b64f770109c4", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386518, "uuid": "75f5bcd7-77b2-435a-b9e5-8a3306d4e185", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386518, "uuid": "12764778-d563-4cec-9aeb-e164ca41e99d", "value": "Confirmation Payment Receipt.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e658dd-93b4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617368745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368745, "uuid": "b7ed7d03-621f-440d-ac5c-35d79114fced", "comment": "Malware payload", "value": "29ee75aca373a198ed1914d9a351ca3a", "object_relation": "md5", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368745, "uuid": "aea3cb59-29d4-46dc-8b9b-1fa0e9bbec3f", "comment": "Malware payload", "value": "e46a16ade0a00728c59210acdcd131a5bab46470d9acb07afb58917a1e287456", "object_relation": "sha256", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368745, "uuid": "218f5cd9-b3c2-4e7f-9289-f3b5b27db76a", "comment": "Malware payload", "value": "11dbb97795fd2a3bb8756c913be53463bc18f22d", "object_relation": "sha1", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617368745, "uuid": "8fdd28c2-8fd4-42b0-bc13-ab61f3d37018", "comment": "Malware payload", "value": "ecbdc8626fc266c8db547f71bcce1df25595455373b6a8786808f21b213064cfcb3734667883028a22c1a0a1703e8c32", "object_relation": "sha3-384", "Tag": [ { "name": "188.225.40.161", "colour": "#7801D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368745, "uuid": "40b00a73-df90-4bff-8d74-d4d838d04eb5", "value": "BF257C027A88CD11C1A91636D9EF45344BBCBD417A22CF6B7EDB336CE8513A26D0D1DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368745, "uuid": "0eaa38ef-a437-4629-b406-e385e54e0366", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368745, "uuid": "76794cdf-4998-401b-ba89-677b0223491b", "value": "24576:U2G/nvxW3Ww0th0ZCSoAr7gCb3B7J2eI+v:UbA30qv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617368745, "uuid": "893d1b9f-6c59-4523-9374-1d1888b34559", "value": 972593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617368745, "uuid": "620a0f2e-5c37-493d-840d-d2ecf0343dfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617368745, "uuid": "7aeefd50-c3b8-4102-80b3-9e17031977c3", "value": "loader.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46970c31-93d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617381690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381690, "uuid": "6665b8c1-12ef-410d-8be8-c5eb064dcda7", "comment": "Malware payload (Dridex)", "value": "f178f2b5ca3ca7e936a254cbfc45c89b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381690, "uuid": "64f36dff-4a14-4995-a78d-05a3d838de8f", "comment": "Malware payload (Dridex)", "value": "e50df8dccbd3c50a3ea254bd2c08565fce964e3411e5b9672c92819255d9da82", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381690, "uuid": "07d3f52d-2df3-4673-91c4-03427e68dd1b", "comment": "Malware payload (Dridex)", "value": "525b84621a3f04378aa3d655b90471f7039a7ec0", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617381690, "uuid": "f83ac730-e977-43ab-bbdd-2c3f18991d37", "comment": "Malware payload (Dridex)", "value": "837570750fd6def32dac02f15c51c6e2db2f58ee46010606ca37b7bac5c5ac8069913be3413f70e25beb82e6a71f3c92", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381690, "uuid": "6d820efd-6b1d-4308-85d4-ead34e39e618", "value": "7E14BE4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381690, "uuid": "43e85452-7e0f-4453-8a20-5ab24457fbd4", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381690, "uuid": "33c1e5f8-9bee-4baa-ab8e-cb1cbea00964", "value": "3072:ropj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:8pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617381690, "uuid": "02ab2561-06ca-451f-9d99-44c3e3811e73", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617381690, "uuid": "696558f0-e290-43b0-8570-99d0f0981787", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617381690, "uuid": "5e006adb-b9cc-43cf-a1c5-835611dbb3ef", "value": "e50df8dccbd3c50a3ea254bd2c08565fce964e3411e5b9672c92819255d9da82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bfd3a89-939e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617359258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617359258, "uuid": "61c48959-e01f-46b8-b0dc-58eee96ed446", "comment": "Malware payload", "value": "c8945321ace8de969661ce58207b91df", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617359258, "uuid": "75ae062e-f6b3-44e1-963e-3dacb09a300c", "comment": "Malware payload", "value": "e5b5c8686df6b2ac5231c35b25b5927eb45910e06807d6bdcba5331de9ceacbc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617359258, "uuid": "3b560879-016d-4727-af9b-3172e844583e", "comment": "Malware payload", "value": "eaf73bd42465625d8a990a14af386449b73acaae", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617359258, "uuid": "143a3671-fe18-4323-9b0b-a9d50f7ed0ea", "comment": "Malware payload", "value": "3d04adb91e5559dc334b17643861e8bc431ab9157ce0cb36bdd409921580d639d1525d8f4119a6274bea3a7ffcba3612", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617359258, "uuid": "f3f1f686-e954-488a-9b3e-eab74b67a907", "value": "70242321119D4D89CE42533A944562C5C7EDDBF35CB0FEA2B81B5A52F21FAEE4C201EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617359258, "uuid": "3b0fc0e0-c09c-4b81-85fa-17c655e93b29", "value": "3072:giEscdDg54U9m4/nY1rYaMjPpMcYYGyjuI7/vpK8OmsKV4L/WFy+8EA23oP8X:ep9U9Cw7pDYYkIkzmsKV4L/Uc3KoPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617359258, "uuid": "06f28f5a-435c-475d-af5c-d0ba6e2fe18b", "value": 211004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617359258, "uuid": "05f8724e-98d3-4591-bf6e-210c2d848acd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617359258, "uuid": "213a6419-c047-43fa-80f7-bc1fc614cf68", "value": "DESIGNATED HOLDINGS LTD, Israel,PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5f0e33-93bb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617372034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617372034, "uuid": "77fbd6f3-329f-4fd1-8771-3860cb97139c", "comment": "Malware payload", "value": "6076d3c8081b7a18d7ceb326fbbaed8f", "object_relation": "md5", "Tag": [ { "name": "MailChannels", "colour": "#06A016", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617372034, "uuid": "7aea4cf6-e479-4b25-ab83-0aa007b8c2df", "comment": "Malware payload", "value": "e5e93ad9a03efad73454ed56a86c9f3fa494fb45303f0aec5326ea9dd4a4a235", "object_relation": "sha256", "Tag": [ { "name": "MailChannels", "colour": "#06A016", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617372034, "uuid": "6d0c509c-8948-4016-b833-7bd3d20710cb", "comment": "Malware payload", "value": "2be5930d2755e388935b7ff1bdd87da43054b27c", "object_relation": "sha1", "Tag": [ { "name": "MailChannels", "colour": "#06A016", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617372034, "uuid": "59e4ebb8-7b2f-4e69-ba8c-d0549f324ae5", "comment": "Malware payload", "value": "8b60092894361ac72bef4416777ff48907234d8fc2bc86a9c0a048926489ee306953973078f941bc2906d9d9eb9a60af", "object_relation": "sha3-384", "Tag": [ { "name": "MailChannels", "colour": "#06A016", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617372034, "uuid": "2e7c5f6b-f62e-4089-b37c-11d76ab79cff", "value": "2493B0E9C712F4E2E6D8CC7CF106B452CD2292635F07F20B5256935F0A179AA5C2E29F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617372034, "uuid": "b55d4d97-6835-40e9-994b-c40c9f44e437", "value": "1536:Cb/ndoJz+kgpei9EM5fybX8dz+HAITWPtsmLMWzMNFOfhOJYS6xybsD9fe2hawZ+:CbpJ5fybX8dz+HzT0s+MWzYoUJixzWMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617372034, "uuid": "971b96d7-4d13-4988-a129-89d02d4185a8", "value": 95672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617372034, "uuid": "4e630fe9-a463-46f8-ae1e-c1dec0438196", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617372034, "uuid": "db7f7645-e9f9-4a65-aab9-0e6427d7c95e", "value": "documents-683917632.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5f3168-93a6-11eb-abe1-42010a9c0039", "comment": "Malware payload (CobaltStrike)", "timestamp": 1617362723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362723, "uuid": "15876fe2-5ae5-4c10-8322-e09da71ca8c5", "comment": "Malware payload (CobaltStrike)", "value": "df00a7a9bb09e38b100195b70e560e49", "object_relation": "md5", "Tag": [ { "name": "99.81.122.12", "colour": "#6905C0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362723, "uuid": "ee210b07-2ee7-4be3-a7b5-5a5e76922a70", "comment": "Malware payload (CobaltStrike)", "value": "e5fa7e3d66f99d172d3eba7af15276e7eb1958748832b8965b9eedba4cbfc90c", "object_relation": "sha256", "Tag": [ { "name": "99.81.122.12", "colour": "#6905C0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362723, "uuid": "4dd2c95d-0ed4-42c9-8de9-e6c68e8e1e46", "comment": "Malware payload (CobaltStrike)", "value": "8aa063d7095fccec27bcab7358ed30f5e030be5e", "object_relation": "sha1", "Tag": [ { "name": "99.81.122.12", "colour": "#6905C0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617362723, "uuid": "a47d0b9c-2bbb-4ca9-b324-ec089ad9ab4a", "comment": "Malware payload (CobaltStrike)", "value": "bf276af7d1884cb01f1b3f2efb41c7da6e62f633f3a7db390f98d81c84b378f321d91a1a8d5ba75b2630845915939cbd", "object_relation": "sha3-384", "Tag": [ { "name": "99.81.122.12", "colour": "#6905C0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362723, "uuid": "a256cb24-6058-47e3-bac0-757116b43874", "value": "9382087FB60268D8C127D07CD9EE6771ACF27023417B671F2BB8D6306E219B8466D909", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362723, "uuid": "a1c95054-03ca-4248-8ed3-5703ef65bac0", "value": "17b461a082950fc6332228572138b80c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362723, "uuid": "cde64466-b98d-4915-ad9c-cd4430ab7941", "value": "192:aoA0TJAPyjLHY219R8C6wtQbYu2KmbxQ2C04kvWgepEt2C+Sj6EUbOD6kxiY:tA0TJASPp6p/D43FvWgep++G6IAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617362723, "uuid": "1a8f9b2f-bce4-4f94-a83a-49e4a520c8c1", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617362723, "uuid": "1a986efc-8021-4f69-859c-448ddb46f11a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617362723, "uuid": "188f4a6f-1a5d-435c-942e-3fe04ed21825", "value": "e5fa7e3d66f99d172d3eba7af15276e7eb1958748832b8965b9eedba4cbfc90c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ddf280-9403-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617402687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617402687, "uuid": "31aeeee1-e147-4f33-bf3e-5b50104c8de5", "comment": "Malware payload (Dridex)", "value": "e30a923a4823f536cbf07ac8dd2f95cd", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617402687, "uuid": "337da889-f5f7-4fc4-94d5-f5bc7e3136ed", "comment": "Malware payload (Dridex)", "value": "e60890760060557b1192fcc6120d459470eb2db52f29b922e0ab6d30266dd8e4", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617402687, "uuid": "6b96a395-f97b-439e-b607-7a340ebd22b5", "comment": "Malware payload (Dridex)", "value": "2d89dc29ff1bed9745d4eb1b56466acc5eb029cf", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617402687, "uuid": "80583785-b913-48bd-a653-bd9444c72742", "comment": "Malware payload (Dridex)", "value": "2e066896f46a378c867ceb02152c2d4e4134077e1e4aea0f2e1f61ec9be7975d29e61898732a4000470097e03a2307a8", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617402687, "uuid": "1c76cd5a-8ea5-4ef7-aa84-d7705a2d88dc", "value": "3214BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617402687, "uuid": "f28b3589-1f35-4036-aba8-f24996e60bc0", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617402687, "uuid": "8b8889ff-94fe-410c-a548-590ec26bd8a7", "value": "3072:Ropj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:mpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617402687, "uuid": "35b539c7-fb84-4c5c-8acd-dec2ad3615cd", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617402687, "uuid": "594f1420-b690-4ffb-b644-ad53d7562fa1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617402687, "uuid": "2e7ad0a6-535e-4f59-a0ef-91e172056095", "value": "e60890760060557b1192fcc6120d459470eb2db52f29b922e0ab6d30266dd8e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a0224b-939a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617357769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357769, "uuid": "f7c5e1ac-cb97-40ce-b0c2-f46a36bbb281", "comment": "Malware payload (Dridex)", "value": "10ea106747162228b7e61fbc8d35e826", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357769, "uuid": "7e1403ef-d837-4eb3-90e6-585b975b1db9", "comment": "Malware payload (Dridex)", "value": "e6e0da5fa5ab3b3e5bf9da16c0bf290c6f51d5b0b9db15cf3a4136db6ca941a1", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357769, "uuid": "af51998f-55bb-4ff7-aecb-75727a6f7496", "comment": "Malware payload (Dridex)", "value": "769c9e6ee557ff3faa06d29af45a820f9970fec4", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357769, "uuid": "1d2007d2-d0e6-49d0-902e-4bc3a5f5dd2e", "comment": "Malware payload (Dridex)", "value": "8ca0f1d03829efaa18d7e099d7df306334e31209c21ef132a6338af7e0d4a443792ea7f50bc5798d66833b26b31c9566", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357769, "uuid": "2af204e2-a478-4989-8dd4-a49b2e535fef", "value": "0B14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357769, "uuid": "34d109fb-c26c-4da9-93ac-4f5d7a7ea0fb", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357769, "uuid": "c5fb1188-9f25-4ee2-be96-04372bc7ba66", "value": "3072:Bopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:WpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617357769, "uuid": "07b997c8-071d-4d48-bced-c6fc8d43edba", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617357769, "uuid": "a68e16f5-6dba-4f14-b40d-745ca26d4c3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357769, "uuid": "e32830e6-5749-4b79-990a-b3b4d0496e92", "value": "e6e0da5fa5ab3b3e5bf9da16c0bf290c6f51d5b0b9db15cf3a4136db6ca941a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f0a37c-93d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617384640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384640, "uuid": "765f09ff-d7b3-4b0d-b6c3-e55f768ae103", "comment": "Malware payload (IcedID)", "value": "086637104bf8d85b7c28b708ea7ed96d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384640, "uuid": "33df0078-e8ef-4e3d-a3f2-19b11ebea877", "comment": "Malware payload (IcedID)", "value": "e71a6d9573488d852c2a12fd73859fa893af21e4021fd02f316f85e00686dbfd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384640, "uuid": "ae9db46b-ccc0-4c31-b983-b66f1970c8fe", "comment": "Malware payload (IcedID)", "value": "c73b301978a681eb387e06ff191d89c19314bc35", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384640, "uuid": "feb964d7-8a2f-4ead-8805-0cd462f1bba8", "comment": "Malware payload (IcedID)", "value": "94a77d0a858b6bdf142b9ce30fb1e9a89a07f744184f6d54883a1ac40986ffbe7f2abeb250894d9b2c7846a664f53173", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384640, "uuid": "3eec0e11-928c-44f4-bf1a-c20fa8af0546", "value": "8B530A8947503C91C0FEBD34F3A69A58931EFB30AA8F47B794C46BBAC47B5409723619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384640, "uuid": "ca08fa80-e654-47ef-b5e6-6de79064821b", "value": "eb10ff98c4adb7472a591c82bd2ff673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384640, "uuid": "a91e149a-bcbd-4ec8-bb36-91d0ba9210f5", "value": "1536:caCAzXz8T6rLXah8lI+Idu+B3XbuF6dRiF:n/gTkXayetu+BbuUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617384640, "uuid": "dd337d76-cad8-4199-98f2-e47ecea3b317", "value": 65568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617384640, "uuid": "95fd49d4-8cec-4311-adac-ed1b0be294bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384640, "uuid": "0303f650-cce7-42ce-aec9-1f6e4f0b73fb", "value": "e71a6d9573488d852c2a12fd73859fa893af21e4021fd.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace093de-9394-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617355232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617355232, "uuid": "10b40683-2dc5-4250-b8fc-ac9b97d71b9e", "comment": "Malware payload (SnakeKeylogger)", "value": "e4ab9fcda8ebcd863bbbde8f9133a90d", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617355232, "uuid": "dea3728c-50f6-4a63-99c0-63a51dfe073a", "comment": "Malware payload (SnakeKeylogger)", "value": "e7ee62aa7a6cdd14b28f628c07c7bbf0b54f7d077702c51a66cac4b44570dcf2", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617355232, "uuid": "52096cc1-bd37-4047-9ebf-261fc2a6bc74", "comment": "Malware payload (SnakeKeylogger)", "value": "b0545222c01d456a925ffd438b9ca45591c5d6c7", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617355232, "uuid": "18408cc1-226e-4a3a-b484-cf869fc008ed", "comment": "Malware payload (SnakeKeylogger)", "value": "3919a56c84a3f8c4bdfc47663de2ab89708766336b1fcf72387c0feac8cccc4fc41532e88dce7631837675f2b6bb9241", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617355232, "uuid": "522029e8-97f2-4a0e-a7da-58b0d7f5f65e", "value": "D9C4D03273E8AF24E5FDA77A5221000057F0EC07E316E79DFDA520DD89A2B858677762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617355232, "uuid": "69480a69-cdbc-4f42-a3b6-864a0f93d2d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617355232, "uuid": "18a01158-c744-4559-9262-344b72fca5e3", "value": "12288:vOGu8ebLI4eDKES9wgyZVW+6yfM8l+4vhnEmRUnvNILDm:vOGX6IlDKEECVW+6sb+4vhn1UvNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617355232, "uuid": "361617e8-85f5-45f0-a808-3ab904855df9", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617355232, "uuid": "d65a0fdf-4201-472d-95cd-017c3285f56e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617355232, "uuid": "0b59e434-4f04-4c7d-b385-aad5688f7e1e", "value": "ASB Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b285538-9385-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617348519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617348519, "uuid": "cef80788-cf2e-4695-8eb0-a2b4724fb1a3", "comment": "Malware payload (Dridex)", "value": "4ff8b7d480cf73952224acb261233e0b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617348519, "uuid": "5f40f5a2-be02-4a10-8901-7a31bb20cbab", "comment": "Malware payload (Dridex)", "value": "e8724c974db8e6b0ac29a4ab379065c3128dc7e24d17abfb8c398bcb57d14396", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617348519, "uuid": "e0b0e9c5-2ead-414a-a177-38ee4e278c05", "comment": "Malware payload (Dridex)", "value": "c182242c2b6a46c2deba8ae8004eb47d80c158d9", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617348519, "uuid": "224c9e97-7271-48ff-a530-434fe151f516", "comment": "Malware payload (Dridex)", "value": "a42b3b175c5b9438eeb7006c456a1b7cf7b2a515e18c8e6a5b7a8f27d28b9f631ac1949a9080f45b8bd5e5d335a15f23", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617348519, "uuid": "1f27890b-d2e5-4eb3-add8-1962e351a525", "value": "4414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617348519, "uuid": "f37166dd-211f-4ee1-8803-11cb9d1b1775", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617348519, "uuid": "6a822627-b994-4f82-a188-c41a67815d8c", "value": "3072:bopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:spjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617348519, "uuid": "769621e9-c29f-47c5-b6fa-976cdae36342", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617348519, "uuid": "fb45fab8-f3e4-48c6-8a40-2b44df4e932d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617348519, "uuid": "299af1f8-e397-4fd0-911a-eb219751335c", "value": "e8724c974db8e6b0ac29a4ab379065c3128dc7e24d17abfb8c398bcb57d14396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba83342-9347-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617322159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617322159, "uuid": "a255489b-fc84-4f61-bf1b-afec30cfcca5", "comment": "Malware payload (Dridex)", "value": "54dd4e3e4b9f8f61a4e3a4359e3f2818", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617322159, "uuid": "7e86510a-964f-4da9-9c5d-5f5e95ee8c38", "comment": "Malware payload (Dridex)", "value": "e8d4fbc94557f7a13ce35dbbe3a6c3143000f42eef45ca486acfaf982de52ceb", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617322159, "uuid": "36541797-6b03-4191-9634-7fc8e6b391b3", "comment": "Malware payload (Dridex)", "value": "182c7a9a97ab890601171000bd302e51ba69b6c6", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617322159, "uuid": "0c4c4509-526d-4556-b04a-7a369aa9df9c", "comment": "Malware payload (Dridex)", "value": "d369067c979346a9c30b9a02e0cfc4dd4bf835238c3d2cee15c016a6c38f8364c45578ef42307a076a73a03d7540b41d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617322159, "uuid": "fc2464ac-fc36-4994-bfc5-a2ba1f801694", "value": "EB14BE4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617322159, "uuid": "ee7a4a8f-4e75-4409-b049-3911274567ff", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617322159, "uuid": "b3845dbc-6db8-4ca9-8e41-6b4fee828a87", "value": "3072:Bopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:WpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617322159, "uuid": "8398e1fc-5f3f-4ee5-b641-3b48b39fa4cf", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617322159, "uuid": "0961e13a-6e10-4d29-985a-c16df7531a71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617322159, "uuid": "8d71c408-d264-4876-bf69-0965405da5f6", "value": "e8d4fbc94557f7a13ce35dbbe3a6c3143000f42eef45ca486acfaf982de52ceb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97c33e5-9371-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617340275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617340275, "uuid": "6ab46a23-fd72-4859-a951-f60c80983293", "comment": "Malware payload (Dridex)", "value": "665ca392f973f0cb08dd2192870f5484", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617340275, "uuid": "dd1d93de-6c95-4a14-bdd8-bdbf00fd8a92", "comment": "Malware payload (Dridex)", "value": "e9e457378b11a3e5e4d84905ba38c20673ea55dfb86caeb9b9fd2be4386cbe01", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617340275, "uuid": "61c09d10-c227-4dfa-a442-8217e53c5ab1", "comment": "Malware payload (Dridex)", "value": "c35320ca648eba26b56dcc530bc2f8e015ab0929", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617340275, "uuid": "62d0c37d-83a8-41ca-8e2c-9b200d5b0eeb", "comment": "Malware payload (Dridex)", "value": "8b39d2617df5a9205b22570b72f912de675299405cd7951fd5849e8585ae37f48a7886941ca96af8ac4840dcb88b35a9", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617340275, "uuid": "481bef6f-7514-48ac-b587-12e79f33225b", "value": "CF14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01E124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617340275, "uuid": "44f58ce8-4e39-4dae-8973-e94a931783bf", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617340275, "uuid": "f7e67705-5f0f-4524-88d6-24dbadf1f932", "value": "3072:a1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ii78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617340275, "uuid": "6a13867f-7e64-42bf-9dab-00bc931f32b0", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617340275, "uuid": "494c3305-1a77-48dd-bd6c-814e17fc8ae2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617340275, "uuid": "fc47ba20-b828-421d-9f35-6149f0fe9907", "value": "e9e457378b11a3e5e4d84905ba38c20673ea55dfb86caeb9b9fd2be4386cbe01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a4564d-93de-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617387084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387084, "uuid": "28551fe1-8ea2-4ffe-8d42-7f0cb3e31f49", "comment": "Malware payload (Gozi)", "value": "a133ba4dee8c87e763eddb6445ae7725", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387084, "uuid": "5c431414-a1a8-4d43-9f1c-6f67472ddeb8", "comment": "Malware payload (Gozi)", "value": "eb617fa7cba6309640cda1035eee2fc79fa77c44b229e3c0213d44d97f1b4426", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387084, "uuid": "c89771b9-1938-45fe-bb1a-e0f2244ca583", "comment": "Malware payload (Gozi)", "value": "ee24296fe8101a3129a25ca3b3ddd25e1ab238b8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387084, "uuid": "1ee7cc88-347a-477a-8d45-893bd6b4ec63", "comment": "Malware payload (Gozi)", "value": "5456a2bba113e11edceceb083e515b262a80a7a02325a8b37f6f9de8bda3631a0370e97171392cf8117683dd2e5c5714", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387084, "uuid": "574e0aea-47ce-4e06-b961-c3e3f8e76896", "value": "78B3DF00B9DCC4C1D3EA99B049A4DE75350AEDA62834900733F37F6D7EF63A629AB544", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387084, "uuid": "f3e1c5bc-bcbd-414c-a2f1-3e7ee3a7e5b1", "value": "811de8e945c2087a6e052096546cd842", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387084, "uuid": "964ab558-c66f-48aa-b638-594d26683a4a", "value": "1536:DWKaY5Se9WnVI78XvnoxJasJvRHKmyGDvDk0Rt9Y56l5ZMpvV05o9OX5xPw8:DWa0eQnVI7qCqZGDvDk4wol5w0EU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617387084, "uuid": "f235d9ce-3abf-4299-86a4-e9855eda33af", "value": 115595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617387084, "uuid": "6a101806-1763-4fab-aa71-d85b2ffdc4d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387084, "uuid": "5b2f5b85-e642-4716-9ca7-48e33f0d6ca0", "value": "a133ba4dee8c87e763eddb6445ae7725.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478e9eea-93bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617372242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617372242, "uuid": "db39aee9-07c1-4a1d-a302-55fde656a9e9", "comment": "Malware payload (Dridex)", "value": "311cead37ea14d46e4534222fb6cb0be", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617372242, "uuid": "4a0c9d47-43bb-4c54-9f55-817a4fff9b77", "comment": "Malware payload (Dridex)", "value": "ecba77ae29edd37ee6be41b5ef8d00fe5b2350ae7001826b2fdb128b5f9318c3", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617372242, "uuid": "6a505f27-7528-4042-b348-71861877d822", "comment": "Malware payload (Dridex)", "value": "85fba7db2f86e0cbcbe360c40b39af3a576fc6e3", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617372242, "uuid": "051cdb76-6104-4451-9966-f74d3dc546d9", "comment": "Malware payload (Dridex)", "value": "cd8015f4d3f580cb3896ce06aae3fa33259c84b630e5b5a2a188bdf12e1a061de57a03ec99767eecf384823f740ac2e0", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617372242, "uuid": "e5cf14c3-e63d-4aa4-8e8e-a3a95780a20a", "value": "7714BE4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617372242, "uuid": "55eea65b-3f84-4be9-aebf-7dfd826e082d", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617372242, "uuid": "b082d0dd-cb77-4679-9c67-e8d8992d0d41", "value": "3072:kopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:bpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617372242, "uuid": "38aac345-bd1e-43e3-8be1-e1cd9b1d74f6", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617372242, "uuid": "cf20117a-58a6-4f22-bc9e-1c7280c944c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617372242, "uuid": "13347a42-53c7-4c79-ab64-88140da3e409", "value": "ecba77ae29edd37ee6be41b5ef8d00fe5b2350ae7001826b2fdb128b5f9318c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364e50a0-9397-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617356322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356322, "uuid": "c2203f95-17ff-4310-9b92-88bd43c0f97c", "comment": "Malware payload (RemcosRAT)", "value": "a60d226f5f28a7faea06456b83037cf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356322, "uuid": "24f4d2a0-6204-4bf2-abc6-30bed7d99eed", "comment": "Malware payload (RemcosRAT)", "value": "ed4da8ec00d25e1207ddca04f696c887744dac5acf31cf8883663f430d7d47bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356322, "uuid": "462543c7-b20c-48cf-81ea-4b0e751bb124", "comment": "Malware payload (RemcosRAT)", "value": "1e89940269ad73d7887e1bb05868b88075535e45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356322, "uuid": "795fa119-ef27-4fc0-9106-a07615368095", "comment": "Malware payload (RemcosRAT)", "value": "e1b1762bd5846c745dd59eac696b6277bdcc3ee2ff27f018fa8fa19c876121b9f4084ced3c39ae3bbca8c71f29cda239", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356322, "uuid": "d75f2add-df22-49c1-abd2-c174a5de34ca", "value": "35B4DF18E3AC5B5DE17E47FB40B072343FFDA1819252FE89EEE110ED29626818552B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356322, "uuid": "c75ee599-8971-4f4c-9a47-44b5fcab4d21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356322, "uuid": "929e8785-f2c4-45ed-bb83-09726d82f70e", "value": "12288:h7zS8lRxpJPK5h5pmI+wH4mluBNQP24Zl58YQ/:h7NlzPK5tmI+C4euBNs24ZDQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617356322, "uuid": "456df925-0ba4-41f1-bcd5-acd72bb1ea7a", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617356322, "uuid": "ceae5d0a-c893-4ba2-b673-03ba14a50622", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356322, "uuid": "ce462fa6-1cce-44d7-8b59-991ea3cb393e", "value": "Transferwise beneficiary detailspdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278bf047-93cd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617379490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617379490, "uuid": "673fdb74-d6bf-4355-80f1-daa87aa09a51", "comment": "Malware payload (Dridex)", "value": "e40be95bc3cf6ba994bb1459957dd48a", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617379490, "uuid": "f6d26fb3-befd-4e1b-a427-a67a74e5bdb8", "comment": "Malware payload (Dridex)", "value": "ee50320c13b23f6d3960e2dbc7df9fbbd338567fd96b7c35badca622c45b1f7f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617379490, "uuid": "dbc1071a-69d3-4bd2-93a2-9362de85fc23", "comment": "Malware payload (Dridex)", "value": "205c35e70e5a64ae98c284e33155c1138f1b71e5", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617379490, "uuid": "7123dc23-81bf-4876-a439-eaccd18ab57d", "comment": "Malware payload (Dridex)", "value": "fe746fcf871a0cb5520234da6079af5dd93b0d4ca0cd20863fb6630690074ce8cbf528b2926a7d770b488c443d83bc67", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617379490, "uuid": "24c36bc1-7b14-45d2-ab07-ef9d34380942", "value": "9214BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617379490, "uuid": "3fb2f06a-52a2-4bab-83b5-e8961ecad5c4", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617379490, "uuid": "c197ba07-2512-457c-bf16-4b74ccf44438", "value": "3072:wopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:XpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617379490, "uuid": "2882e204-7f75-4826-8bf4-9400fba2a33e", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617379490, "uuid": "a344d02e-28e9-489a-816e-86323fd69c91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617379490, "uuid": "8f6709e0-ce77-4a8e-b63e-65099a5d8deb", "value": "ee50320c13b23f6d3960e2dbc7df9fbbd338567fd96b7c35badca622c45b1f7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766e1a4f-93d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617384347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384347, "uuid": "56d35772-f318-4d77-bd32-6a66b285287b", "comment": "Malware payload (IcedID)", "value": "c4d555d9cafbdadcf3eb992833ec563e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384347, "uuid": "e913c7c7-ec15-4e78-a31e-0dd113c2c0f1", "comment": "Malware payload (IcedID)", "value": "eeb0de4f4ecce356b213e09834c4b54bb942c51ed2a9808eeb99fa92236f0f53", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384347, "uuid": "8c9a11e6-35ed-47b7-985e-f2f417841b01", "comment": "Malware payload (IcedID)", "value": "6fd73bf2b7f8ab55ed4b8fdcb01b20d8312e00b0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617384347, "uuid": "e784f7b6-3877-432e-8579-ba08cc9ff414", "comment": "Malware payload (IcedID)", "value": "e008a5eade48d9000e20f931f9d7111f9fc8af403744a5c12479c7513d53fbbb2bbd5c90df8cb42a5c712a1f3258330a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384347, "uuid": "add72a80-9f51-4377-a7bb-274bc1892edb", "value": "8C530A8947503C91C0FEBD34F3A69A58931EFB30AA8F47B794C46BBAC47B5409723619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384347, "uuid": "5b04816b-5cad-44b4-b1a6-2ab305c64b1f", "value": "eb10ff98c4adb7472a591c82bd2ff673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384347, "uuid": "47e7b526-f01b-4c83-b359-d1a24b67218a", "value": "1536:caCAzXz8T6rLXah8lI+Idu+B3XbuF6dRiF:n/gTkXayetu+BbuUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617384347, "uuid": "61853b67-b2cd-4c1b-8e77-90493ecc3071", "value": 65568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617384347, "uuid": "45244308-fe7e-4ac4-8235-c5b859ed3dfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617384347, "uuid": "d2eb8c45-8c10-47ee-bfc4-3004b351bfef", "value": "eeb0de4f4ecce356b213e09834c4b54bb942c51ed2a98.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63566bed-9394-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617355109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617355109, "uuid": "e216e35d-c919-48e7-a483-201764131257", "comment": "Malware payload (Dridex)", "value": "2b6ac4859f18facccdf974eee5279696", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617355109, "uuid": "c2bee692-4e66-4789-901f-6434ead51203", "comment": "Malware payload (Dridex)", "value": "ef4419fdfe1019e783c7a009649cb0426a60f007fe9d4260d49ba9c760b6d19a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617355109, "uuid": "dacd7aff-774d-4373-8292-0a4106e8ecd0", "comment": "Malware payload (Dridex)", "value": "56442c23583554648a7819f2d4e6ece7feca5383", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617355109, "uuid": "a7d2630f-e56b-44fd-bf8b-8be4aadef448", "comment": "Malware payload (Dridex)", "value": "27c58d426e3f54b42381ac83cf8009fec074dfcd9780cecd365b03c74040019f226fe9bd39d73912200e2221c31e449e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617355109, "uuid": "caa7ae54-cc6f-40a9-a485-d76fe901ffb8", "value": "C814AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D164D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617355109, "uuid": "114b246b-3046-492c-932b-ec665a7edf42", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617355109, "uuid": "8e9a3e8f-084d-4045-ab68-5e91c2f298a5", "value": "3072:f1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:9i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617355109, "uuid": "41676b26-7cc8-4ff6-b4fd-ae2f8d05bc17", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617355109, "uuid": "ecbc2060-fd08-4bc5-aaa6-985be01370d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617355109, "uuid": "ccc5b5b9-3ad3-46ac-b0be-b2380ad2e585", "value": "ef4419fdfe1019e783c7a009649cb0426a60f007fe9d4260d49ba9c760b6d19a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ed9830-93e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617391861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617391861, "uuid": "ead8ce0c-82cc-4aa9-b0ba-ddf3c1c9547a", "comment": "Malware payload (Dridex)", "value": "961f0d2dcb2b6f71db1b009d898c6ecb", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617391861, "uuid": "6937f625-1dc1-46f0-bcca-38a2ea8b80ac", "comment": "Malware payload (Dridex)", "value": "ef61a27b7486c49d5effb4ad37ba73181f1f4cfdee6914acfaa90f3de0d7105f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617391861, "uuid": "542ab4d9-5420-49a4-a11b-6c4a8fcbc8ed", "comment": "Malware payload (Dridex)", "value": "6e8b6c8b52391bf91a72df77b3c5cc14de75eca2", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617391861, "uuid": "33547ce3-3b3e-422c-a914-2a8b9430986b", "comment": "Malware payload (Dridex)", "value": "e89c3fb1262c9e9eadbfade2c579c86723269e05be09e899dc318cec0f54ba69173ec6063e642fc8a25eea222add5778", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617391861, "uuid": "2e509112-1a13-4702-9b96-f991a04d971b", "value": "8214BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617391861, "uuid": "200c3fad-916d-4434-89f9-531cfe47d87d", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617391861, "uuid": "6b538f06-8bd7-471e-bb49-05fd439d3226", "value": "3072:0opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:rpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617391861, "uuid": "deebd867-468e-470a-a89f-83a1245af871", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617391861, "uuid": "8eef54db-028e-44ef-b926-a2fb1ea0143f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617391861, "uuid": "fd017e8a-7a90-405a-b732-5fc51d2ab160", "value": "ef61a27b7486c49d5effb4ad37ba73181f1f4cfdee6914acfaa90f3de0d7105f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f89e96-936e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617339002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617339002, "uuid": "cca95a88-3dc4-4bfe-afa8-c314aa0a9bed", "comment": "Malware payload (Dridex)", "value": "afd831ad5b0048dbf2611eb96bff60b6", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617339002, "uuid": "509eebaf-f4ff-4de8-aa2f-a6c08431bd04", "comment": "Malware payload (Dridex)", "value": "f22239f7b024979525013f44c606877c3c02444c6f3b6d9b71eb5255338f0f16", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617339002, "uuid": "fbdea566-cb0c-437c-bb86-8352835c9f12", "comment": "Malware payload (Dridex)", "value": "ae477603a29355b19de7f55eee51986df7713253", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617339002, "uuid": "a7a9bc74-7715-4172-8ac3-1e2b7e81f348", "comment": "Malware payload (Dridex)", "value": "5f3ab7726d2c4c7da3b833d93af50a103338e999e41dd8966ddd9747afc6cfa2e3053d762ec605c5aa3e4e7fdfa4e423", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617339002, "uuid": "802ff5b6-7b8e-4902-b3cc-b36c99ed3e84", "value": "5714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617339002, "uuid": "b94faa02-b462-4d28-ae35-ed6767c46db9", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617339002, "uuid": "2a8e6d93-8cff-4d29-87a6-fe09d4ef2d27", "value": "3072:dopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:SpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617339002, "uuid": "98239e53-9943-4635-966c-e06d68b2cc91", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617339002, "uuid": "d55302de-aada-4a4e-9329-ef7e394861ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617339002, "uuid": "6153af53-f4f5-487b-b043-a240b4418244", "value": "f22239f7b024979525013f44c606877c3c02444c6f3b6d9b71eb5255338f0f16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bba0664-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617386557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386557, "uuid": "4e0636c9-22b4-4d6b-9b7d-0df8eceda937", "comment": "Malware payload", "value": "70503b73ea6e0bcdca6a4f1eba01a235", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386557, "uuid": "5382a6eb-c37b-473a-a62d-bd018d039005", "comment": "Malware payload", "value": "f3100e1ff79518aafd23f706e705e0c0639c4d76cb42df14a73268ab78aac4e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386557, "uuid": "acb02b2c-d902-453b-9914-6795ca170057", "comment": "Malware payload", "value": "b441abc9dd5656b4bf7fddf299307ca3bc5d0e83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386557, "uuid": "5106931d-e174-4786-976f-ed4e40a5f7af", "comment": "Malware payload", "value": "0750c9fa92c59aebee0ee7968ced6841834bc68ea2078de971ac9cc982509d9089dc8ce314eb76ae377006eacfa9b3ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386557, "uuid": "998375fe-323d-497e-905e-0051525e8b35", "value": "98C5336616DDD813CA02DE350C3E5E1962350D99F0D8FB01336BFBAB6A396066C3DB49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386557, "uuid": "821efe2a-894a-406b-8295-b4165c98969a", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386557, "uuid": "659f110c-17a0-4ab4-95be-7d2bc30bf587", "value": "49152:Mh+Ja1ecQlcYlL+35uALXmQJOHiQ6UJoyiSy8LSeFJcwaofB/Fn9Ctw90gj9ZIN:Mh5eXlcj3giQ6UPyleF1fB/F9X9NHIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386557, "uuid": "cc850b33-1d7b-42c2-910a-84a8c6a0b86b", "value": 2705943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386557, "uuid": "1059d24f-33c5-495e-8a3e-57f2441e7308", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386557, "uuid": "246788d1-15b8-4c6d-9492-ed10d67e2822", "value": "70503b73ea6e0bcdca6a4f1eba01a235.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d8424a7-93ab-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617365005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617365005, "uuid": "ae418fe9-1c2b-429b-bee7-4361936e3a5c", "comment": "Malware payload (Dridex)", "value": "53be1e0dd5bfd1a9e9ca513f312c7714", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617365005, "uuid": "029ca56a-1955-494c-98cb-eea287cbd495", "comment": "Malware payload (Dridex)", "value": "f32bba9cd3f4e60327ed0b433cca8eb359d01fcfa57ef8eb4544dc44651b798e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617365005, "uuid": "7ead617a-1daf-40f7-9736-057d67131e7d", "comment": "Malware payload (Dridex)", "value": "111b96d1c0f69195a4d4596401df5297e7df85ac", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617365005, "uuid": "0f31d3f8-39a2-484c-9572-4433a12fc5eb", "comment": "Malware payload (Dridex)", "value": "3c096ab6fb5813ead9adf4aedbebbdad8324e8559cf81ddf468e2e3a66ee9ac89e0d2471cb1bcec6da92731b487261f2", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617365005, "uuid": "7cb3b32c-e9b4-4c08-8220-62044d129df3", "value": "6914BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617365005, "uuid": "e989712c-df81-482f-adea-1cf100967f6b", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617365005, "uuid": "422456a2-5342-4194-b4cd-ca9f070e8a6a", "value": "3072:Sopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:lpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617365005, "uuid": "15935758-b606-4b3f-b8a3-b664f60516f4", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617365005, "uuid": "8b0bcad9-db75-41b2-9082-a1771d0353ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617365005, "uuid": "568c2f80-efee-47e4-a029-644c9798347c", "value": "f32bba9cd3f4e60327ed0b433cca8eb359d01fcfa57ef8eb4544dc44651b798e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81f3c1f-9364-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1617334716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617334716, "uuid": "08879843-d4b6-4b75-ab88-4dc7257b647f", "comment": "Malware payload (GuLoader)", "value": "287073f3d2c3100ba375b7bf0db3b0d9", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "www.sogecoenergy.com", "colour": "#460AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617334716, "uuid": "f989ed1a-ebc2-4ef9-8614-f2240a64f10a", "comment": "Malware payload (GuLoader)", "value": "f32f7005937b4c94ff31996fde6a0843c05bfb47458ad29a15ddf3fb70c435d2", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "www.sogecoenergy.com", "colour": "#460AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617334716, "uuid": "8388d5fa-c536-4181-8e4b-9ac253400203", "comment": "Malware payload (GuLoader)", "value": "8e09353697169cd3caaf49a008d53ade63b25526", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "www.sogecoenergy.com", "colour": "#460AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617334716, "uuid": "91fef04f-ab09-4620-9a8a-e2bf6a70bb4f", "comment": "Malware payload (GuLoader)", "value": "3ebfe36ca5ede04f2c358e6d0a77de389643602361dac19b3ffbe5f022e5d08bcec649cab099952603fe60a054791745", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "www.sogecoenergy.com", "colour": "#460AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617334716, "uuid": "18be68c7-1a04-4307-89f8-03bbc3552e94", "value": "5EA31AA2F320BBF2E97586B51F0109AC00977C7017155A4BF1DA390D26F6BDCE568B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617334716, "uuid": "8c02d38a-9b47-4c36-aa97-9281d1523b45", "value": "0a9ef7cc3833edd03402bcd316bbd785", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617334716, "uuid": "ba7ba9ae-085f-42e5-b7dd-c97106738db5", "value": "1536:4YNgd2V1trE261H7R/F7ogTI+ri7KJWUv691OGPmahFGo6LcsoWFM1SR5MS:4bEE2YHd6gU+SrJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617334716, "uuid": "82dd7260-dae2-4343-9ad0-bf7aeac2454c", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617334716, "uuid": "a166e6c4-b5d9-424c-af72-ec8229a44fd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617334716, "uuid": "8434478a-51a6-4883-a5f9-830f78626251", "value": "MSIA2F7.tmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c9ef3d-9399-11eb-abe1-42010a9c0039", "comment": "Malware payload (NetWire)", "timestamp": 1617357479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357479, "uuid": "d12ddbb8-b201-482c-9b81-d91c4d2f12cd", "comment": "Malware payload (NetWire)", "value": "2a39e3c30150fda6a237433c8420a595", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357479, "uuid": "3092e71c-52ba-43bb-a4e2-430e394134b0", "comment": "Malware payload (NetWire)", "value": "f479713c70cbb107873b10f939f4e1ecf4f75b9b6094bb5da0111ed3bf7c3748", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357479, "uuid": "756a727c-3ef4-4843-a838-d9456c7d2ba0", "comment": "Malware payload (NetWire)", "value": "09acd22dfbead06ecabefe804708a8846fe04d09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617357479, "uuid": "b2ba18fe-8f9d-4260-a16c-a5f5e7103471", "comment": "Malware payload (NetWire)", "value": "f0b7882b11929d1f7f15d052771b32ee3f468ab38036ac8db4475e42c1dc93748323d0d39263913ea48820922ca7ab59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357479, "uuid": "8836bfc6-055f-4314-9b42-bd779f201c32", "value": "0EE4C030538C67A7CE3E1535C810564042F6AA473A12DB9E7CD4329E2DF2B1A6B72F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357479, "uuid": "056b1c4d-b005-4021-9db9-6f20e45b947f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357479, "uuid": "d2e3b228-d37d-472d-87b9-6f8ba36c1e94", "value": "12288:+u94iX1BWuRTB/ie9LxRcWo/uwAjsvr1XvM71v8u6ik:+u6iXxBxieHaW/w1vr1071kuJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617357479, "uuid": "9750b301-ed8e-41c2-b822-3ad5bd793c5e", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617357479, "uuid": "236cd4d1-5057-45f2-bd2d-4b94a3a92068", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617357479, "uuid": "dee65f1f-9fff-41d2-855b-7278f9f17214", "value": "1VzQLgPeAlfHSHQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a22f439-9370-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617339498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617339498, "uuid": "e1064e80-eb7e-4780-8174-27cea2a6743b", "comment": "Malware payload", "value": "0fb40124ecee2a84925c0ef1e8780d79", "object_relation": "md5", "Tag": [ { "name": "mariotessarollo.com", "colour": "#65BC8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617339498, "uuid": "c6976fba-1e1d-49d5-a913-c030e7f45aec", "comment": "Malware payload", "value": "f49571e7e14432131ddb759e3ed90c3bbd358b3b54db8c8c2c2707808b9994a3", "object_relation": "sha256", "Tag": [ { "name": "mariotessarollo.com", "colour": "#65BC8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617339498, "uuid": "0a341ad7-948f-4f7a-bfed-03cbc17f8a84", "comment": "Malware payload", "value": "d9a1a7be84c007d4d0d647010eaf5ace80a8a482", "object_relation": "sha1", "Tag": [ { "name": "mariotessarollo.com", "colour": "#65BC8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617339498, "uuid": "9874e868-7064-4416-a074-23bec22b0f69", "comment": "Malware payload", "value": "d8929432654deed25782f1f84569573d4c72685cddda9faef364a1cc6746fdc3e967564c33903d33fc8acaeba098105f", "object_relation": "sha3-384", "Tag": [ { "name": "mariotessarollo.com", "colour": "#65BC8D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617339498, "uuid": "973f8c88-ad73-46e6-b900-f232bf298d86", "value": "B9D30290FC625090A1A0A43D3217F1E267534F56FE07CAD01BDCDAE8351D792AA2DE9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617339498, "uuid": "dbb2d575-a68f-4597-ab45-40cf3d89d466", "value": "3072:sw1jJwXiriu2EhJIn8+Omr00/jPsg2KO+36b+lZ+SZ6qm0zOotH:TdwZuHhJIn8H0b2+8I+ibK8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617339498, "uuid": "abb106bf-49a2-4f0c-9538-8c6cd0ebb908", "value": 135232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617339498, "uuid": "d90a123d-f5fe-4f0b-b2a3-78e1c590d7ce", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617339498, "uuid": "6473ab2a-f8af-40e7-9887-e5e8edbdcf9f", "value": "specof.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a8502ab-93dd-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617386421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386421, "uuid": "c5cd955c-1a6f-409d-8543-4a5cedbfa22d", "comment": "Malware payload", "value": "e577c0f5c4c418770c4239f40fd6695f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386421, "uuid": "0d04bbd3-f88b-4b70-8159-e50fe70a65c2", "comment": "Malware payload", "value": "f4daad4a0dd39a6a4fdc06cff8f96706b44d1e0207f13d80eb988c6e82ceb0e9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386421, "uuid": "e97eed2b-984c-484c-a7a4-01c547519552", "comment": "Malware payload", "value": "a4d158c84c0430629015cd25e54e3a7672d05028", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617386421, "uuid": "54f1244b-7953-4eca-a7b2-e6fd460d8f0a", "comment": "Malware payload", "value": "36631696692ae74c74c5cf57abeded20518615811d4c907dbd8ab28faeb3da286312a4c9ff38d3465f88ea046bf31156", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386421, "uuid": "4ee50c9a-b61a-41ae-8849-4c42345dacb7", "value": "E804123CC03B4D98C2E68437DC588546AC662523BDF8A5BD66887598EA136F30F6FF44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386421, "uuid": "2fb41a5e-ff19-46c3-880c-95f8fad4ca83", "value": "3072:BXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGXKC:NE5SDvbXAyHbVt15wTQDmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617386421, "uuid": "087306c2-5259-4eb8-8b75-5498809472cd", "value": 178001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617386421, "uuid": "171665d1-f9e6-4ba5-88f4-22a67113c19a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617386421, "uuid": "e9c70b9a-30f9-43ce-b68b-a0d1b1ce03fc", "value": "71559035622-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0efd50e-93aa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617364661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617364661, "uuid": "b5b111d7-7e18-4be9-8b4a-25fad549419b", "comment": "Malware payload (Loki)", "value": "cc6e140fe07f161c13663b34c2793a83", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617364661, "uuid": "b71b343a-1466-4e98-8576-955287646b49", "comment": "Malware payload (Loki)", "value": "f593b98b97b8289157e6e8dfad61032bb8f81440627cf9976b9fbc5f96e08383", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617364661, "uuid": "38646736-328a-4f10-b1d6-acb55285bd33", "comment": "Malware payload (Loki)", "value": "477cdb0b2e189971cf3987d169ddb0a7dd7d93d9", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617364661, "uuid": "adb08bbd-7c39-4c57-a540-f7406c7fef4b", "comment": "Malware payload (Loki)", "value": "7be4724038c002fb9708b53c5e7a0da03447e86827c9c32438fe81d02daa5cf92a966e76777beb6e18d005caaed37274", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617364661, "uuid": "c950b1c8-3edd-4644-b436-8f7dcfdec4ad", "value": "D9B4BE38C3AC095FD56E24FB803172707EFD8692AA52FFC8EEE019EC5581352463925E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617364661, "uuid": "b1b2b659-2733-4201-8d23-9f2790ece7b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617364661, "uuid": "d848c6b8-d499-467c-9e7d-c90adba0cae9", "value": "12288:nRs9BHrUTtXhOjCWSApPklpHFwcOEdqDkNR/+sCqkupcKwu9Bp:MjCWvpPk7HfOCHNR/8qNpcKR9Bp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617364661, "uuid": "fb5c047c-a3e1-45b0-9325-bac57c9cffba", "value": 509440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617364661, "uuid": "3ea679ee-4515-4a4a-a2e4-9f8e0452825b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617364661, "uuid": "7fd49d16-2466-4a4d-958d-fc4141ff581f", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4877b8-93df-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617387258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387258, "uuid": "1cdcd406-a495-40ab-ac75-b1c97432c2ce", "comment": "Malware payload (NanoCore)", "value": "f74053468e92f5a6cd7289d5aa555e98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387258, "uuid": "9af21117-1f23-4c0e-8792-fa86a82c4100", "comment": "Malware payload (NanoCore)", "value": "f59b198c116e26ebea1a72b8e95de95c6ecb5ddd0698359a6830f4c9b1b56d1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387258, "uuid": "f7d1253e-83ef-4132-96b8-e327a213e7a5", "comment": "Malware payload (NanoCore)", "value": "4140dd36ff13f8aeb6abec26b308281460ecffcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387258, "uuid": "153b1d38-f5f6-48ba-bdb5-d7d41d5c8b42", "comment": "Malware payload (NanoCore)", "value": "73dbebec765b09e113788496b041d078ea59a0e120a36e267bd388a7aa7ae87481186c969fd1d168ce69231c186b8932", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387258, "uuid": "9dde7209-712b-4f6d-9701-2503c2a2b4b9", "value": "29354A8C1E99C2CAE2794BB891D9E49943F56EF38F12CC79BDD447CBC230B41E606526", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387258, "uuid": "a99faf27-f01c-45f5-8530-7f90f22fee1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387258, "uuid": "c2efdd48-6e31-4150-adc3-db4eaf5c79c8", "value": "12288:ExJyzSk/SanhYZSYQB99ogfjIf8DaJZTFVPvu3ddCB3F3vcVl6BRSzzzq:EyP+ovhcf8u1V3uOtBvcH6PWzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617387258, "uuid": "8a175757-2a03-4f82-8b55-638c9f30e354", "value": 1152000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617387258, "uuid": "c547e1da-c301-4281-a649-b55656c61f44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387258, "uuid": "9192cae4-83cd-4b54-b89b-56b317c295d5", "value": "f74053468e92f5a6cd7289d5aa555e98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe8770a9-93a2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617361382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361382, "uuid": "c67d11de-c10d-4b49-bcc2-4cf4401338c1", "comment": "Malware payload (Dridex)", "value": "a957cd4d0ef5521d54c4dd50acc92710", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361382, "uuid": "2eb8cc10-ddef-4ab2-8c0c-14533252e094", "comment": "Malware payload (Dridex)", "value": "f81d8aab2ec6dd9b097cb547c0f96f4a0074074fd39ea7c8a8d1f3d405c07648", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361382, "uuid": "6ee480f3-a827-4445-bef5-af3a9a9e201e", "comment": "Malware payload (Dridex)", "value": "2ca276a8c0b518bb86ba69222f51381698d7a24c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617361382, "uuid": "acc945ad-6d11-4979-9363-250e3972ff89", "comment": "Malware payload (Dridex)", "value": "381734374ec7c315b0fc4947af294034195cd26ec4b73694b27e6092158aa65f20f7470f82532e22ef9e651182a711cc", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361382, "uuid": "43093831-8845-4b51-ad37-d47d88ab6eb7", "value": "2A14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361382, "uuid": "ad910b5b-859f-443e-8b1e-9236ff21a837", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361382, "uuid": "9ad5c52d-079a-49bb-95d7-e12c35d6df80", "value": "3072:Bopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:WpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617361382, "uuid": "d4260377-6f14-4bb0-9c05-cc3f3494d1ca", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617361382, "uuid": "0f621131-c38a-4a10-bb63-519229ae8c09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617361382, "uuid": "ccd012d5-d8c8-49b4-b06d-cc23dbf354f9", "value": "f81d8aab2ec6dd9b097cb547c0f96f4a0074074fd39ea7c8a8d1f3d405c07648", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb50110c-9353-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617327420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617327420, "uuid": "6b2aa4fa-fa79-4816-aa28-beb22686d41a", "comment": "Malware payload (Dridex)", "value": "3a83fd7b89d7b6d67ffba12120bf3f90", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617327420, "uuid": "eae1d28b-c4f6-4ee0-9c1f-94f151c22971", "comment": "Malware payload (Dridex)", "value": "f842ea106e6abb5ae0b440f8cf61e613249f3873285be8895d758b0d73694870", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617327420, "uuid": "d1b6d529-c592-4a19-ac4c-525efb6743b4", "comment": "Malware payload (Dridex)", "value": "6d396d5f440aed74c95d9faacf9b6bd69fcd9f82", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617327420, "uuid": "12ca178b-f663-41f5-9f9e-03c8f9f00bed", "comment": "Malware payload (Dridex)", "value": "ac8da05085cfde3b3c1a0c4d666d6e1cab378290fc97646cefe21bba3dd9dfd94d0bc14257636066675c3fede641b4a8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617327420, "uuid": "b1274764-27c0-415c-8b36-2a6c5b7c4270", "value": "EE248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617327420, "uuid": "5d63468e-4182-4b4e-9f5f-f0eeb9514d05", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617327420, "uuid": "eea49f63-9cf7-4373-a9d2-02b259300c50", "value": "3072:06TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:0oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617327420, "uuid": "fae6f3bb-ab0a-4a07-96c6-7caad28b6054", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617327420, "uuid": "b996752e-7660-40b9-84f0-66be93d12f94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617327420, "uuid": "9f20c858-72af-4b7f-8533-8df7bda1b60a", "value": "f842ea106e6abb5ae0b440f8cf61e613249f3873285be8895d758b0d73694870", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9431f1-93a7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617363498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617363498, "uuid": "678ce38f-b7b5-453c-8e0c-af9074064892", "comment": "Malware payload", "value": "610bd814e62732cc6d5bb690be3c1a8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617363498, "uuid": "aefe1748-aad1-4e27-83fd-5b01ab0c39bf", "comment": "Malware payload", "value": "f896cb6d8199a5b886a505f7821ba7e259edb74d72f8d5665469e0f64d698cf6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617363498, "uuid": "755f82e7-683b-45ce-ba4e-41993832e63b", "comment": "Malware payload", "value": "86a24ef95c8e2c02f6ec07efae736d9eb6eeff6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617363498, "uuid": "ef8b0c4e-66c0-4331-8c8a-1aff23a9a4a3", "comment": "Malware payload", "value": "db3132774498a0b063706b826599b8a4cded109a78e96bc72ca5f2ceba8f76d62549e70697a84cfd90b9d84f7f221c82", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617363498, "uuid": "25c68d24-0a26-4bcf-a0ee-2a6993030283", "value": "EF9423C7F63B949DFEC7D213067A7151E427E14814B4A0AFFCF909591DAF84A4B220B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617363498, "uuid": "4543e478-0cd2-493c-842b-a641d5754147", "value": "12288:JQD3/Pgigyi3SRbOuhwzhR/3K0DkyDmwwj:JQznMCI0Gp3K8kyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617363498, "uuid": "510d1edb-9aa5-46bb-94ff-406b188c632b", "value": 441319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617363498, "uuid": "a3ea3e7d-c5a0-4b7c-b2fa-69b041c2a6ed", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617363498, "uuid": "afe43b51-d1b4-4eef-9c98-1cd64be5fe7d", "value": "PO 4524586683.ISO.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f779829-93da-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617385248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617385248, "uuid": "b26de647-56cb-40d2-b0c8-b24b8b4bd9f8", "comment": "Malware payload (IcedID)", "value": "ce6ee48d0fcd8067e8b55a6dbde4ca4f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617385248, "uuid": "88ebd7f0-3bb8-440c-a655-3fa5fab8f5a3", "comment": "Malware payload (IcedID)", "value": "fa192705d2d6976f6d3453462e27c1278fc3c57dd5a175e73439a9dc14b01f02", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617385248, "uuid": "28308be7-ede0-461e-a509-43b188509bb6", "comment": "Malware payload (IcedID)", "value": "6072d9b0e15e1eb2f92b454b6bf9aa5aeec78ba4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617385248, "uuid": "75ff93f6-bd8b-40d0-9278-2b12c8c6a50e", "comment": "Malware payload (IcedID)", "value": "a3fe5a4354106352fb0881502730b7e4145ceb2268f3708fb5449de8336798a3ceeac29e01b2f6f03f4fa3813d25edde", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617385248, "uuid": "e1e006af-c4ba-49f7-82d5-75cabd9d5c9f", "value": "74530A8947503C91C0FEBD34F3A69A58931EFB30AA8F47B794C46BBAC47B5409723619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617385248, "uuid": "a1312cde-2d18-4aec-b40c-e88da2bf15fb", "value": "eb10ff98c4adb7472a591c82bd2ff673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617385248, "uuid": "2416813d-0fbb-4fce-8187-693a2728e9fc", "value": "1536:caCAzXz8T6rLXah8lI+Idu+B3XbuF6dRiF:n/gTkXayetu+BbuUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617385248, "uuid": "f232bc30-8ebb-4df6-a10c-1bfbd994e07c", "value": 65568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617385248, "uuid": "fe6913e9-b677-4841-a977-6ebf047b8dd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617385248, "uuid": "42a78a05-684d-4eeb-a931-53faf53f1291", "value": "fa192705d2d6976f6d3453462e27c1278fc3c57dd5a17.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1652c2c-939b-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617358327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358327, "uuid": "8e73140f-a583-4584-8989-7bfa163ebfe1", "comment": "Malware payload (IcedID)", "value": "929e9fac2785cf4f8bc82a9b50bd8962", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358327, "uuid": "bdc092e6-0007-4399-8669-5cc618fc04bf", "comment": "Malware payload (IcedID)", "value": "fa391aa80eba03870abb2514f0cd48c397807bd1aed622bcdc55948d695f12a3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358327, "uuid": "9943fa86-f8b7-458a-9e31-6bb48e92152a", "comment": "Malware payload (IcedID)", "value": "398106c93d55e3fcd97475e4b393eab8316f5b47", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617358327, "uuid": "3e5c5734-53a8-44fc-95cf-7cbe5e207566", "comment": "Malware payload (IcedID)", "value": "6ef5aa4a0fe29e2b9f6d4e312fd6fc0a769c53f5a77724c55230b6de45e3b9d54a71db338dbca26e28fdcd08248da005", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358327, "uuid": "4a06f11a-6b42-4f13-8964-32ec6d24d2dd", "value": "30C3298D6B907CA1C0FDBD34E3A19698821EFF309A4F47B794C5AB79C0AB5409623749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358327, "uuid": "aedc4944-2f6e-4967-b6f2-f9ebc2f96594", "value": "eb10ff98c4adb7472a591c82bd2ff673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358327, "uuid": "b4d0fc49-e37c-4b41-b012-36fb21539c76", "value": "1536:fmXIFRBSvf0EW6SL504jXnk1Nzva2Xj3108/l:dbafVsL504jXk1RvlXJdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617358327, "uuid": "c0eb589c-3334-474b-8e5e-3226e42fdcf2", "value": 120040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617358327, "uuid": "d30cc0ff-b45a-4a48-ba17-40cf0e3d8dfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617358327, "uuid": "394a15fa-ba39-4064-8a63-95af9350d2be", "value": "0204.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df332d6-93df-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617387232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387232, "uuid": "9f3295b2-8aa2-4619-b312-3b67ad14e236", "comment": "Malware payload (NanoCore)", "value": "29797529aa8bf8be77c28df5f59530fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387232, "uuid": "ee89c2c7-b16f-473d-abad-61c5cb546e46", "comment": "Malware payload (NanoCore)", "value": "fc103625cd3da02c6b1c82e0220a36118133c579e03c27a904ccb524d3b99a3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387232, "uuid": "4f731551-a0b6-4783-b75a-e2b1dd6a7235", "comment": "Malware payload (NanoCore)", "value": "1ef483bba631ee009f727f3c031328912f5cfde1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617387232, "uuid": "b0ec840b-303c-4c30-b960-8876ba3e0d10", "comment": "Malware payload (NanoCore)", "value": "c8d98644975d354905a1c4793b4facfab5d51cb2a3ac0064c8ca4ac4506a879c15b9e76c96b6abe6b50bcb7825d5e3f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387232, "uuid": "92b848b1-81a4-4f00-9417-5037e89f49a7", "value": "EA25E03037E69248EA79077008759195177AFBF67B17CB1E2128925C9D22B8F8FC1B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387232, "uuid": "c904383e-d159-487e-9cf8-6a136f77d0c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387232, "uuid": "5fb87e50-043a-415c-92f3-bbca1263888a", "value": "24576:X1hSl/WHfPjVNi4R4Bc+FZX2tFTSs+RwVK:X1hw/WHZNi4R4q+/2tFTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617387232, "uuid": "203fdacd-3896-4af7-92df-4f20151ae4d9", "value": 1009152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617387232, "uuid": "8224829f-6ea3-4b8c-8a44-3c4992404b01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617387232, "uuid": "dbcc4c23-1452-48b5-bc92-8239bdaa3d7b", "value": "29797529aa8bf8be77c28df5f59530fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82292775-9397-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617356449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356449, "uuid": "685cad7e-018b-42f8-9a16-db69f933bbe0", "comment": "Malware payload (AgentTesla)", "value": "26dc243c48d0facf528b24cddece8af5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356449, "uuid": "6e71ebbd-7365-4096-88d8-34ca6b081ad1", "comment": "Malware payload (AgentTesla)", "value": "fc31f18e88573575f343e7def6b7a6c52f08ab0a3c2239bd10477a7f71509520", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356449, "uuid": "e3bbfaee-e275-49ef-8a48-184cc87c9dbc", "comment": "Malware payload (AgentTesla)", "value": "ac69bbc2d4a0f544d77363b92898686047df37cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617356449, "uuid": "d49aaeae-61d5-4246-b0d7-f7c7f909b44a", "comment": "Malware payload (AgentTesla)", "value": "c945bc449081b7a46ebc4f0b856213bb3a66b420c35d8077718d9c30bcfea0e84b8d884f8ccfa6cad507fecdd8d331fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356449, "uuid": "4dd291dc-b6e9-410f-9431-b06cc352bc2a", "value": "9E25AD293F64614CC4AB07395829D10C9FE67DA9A6D3C2837EEE37DB6073F1306A4652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356449, "uuid": "e7bfd76c-5ab4-46ff-bdcb-56eabe40a3a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356449, "uuid": "634a799c-4bc4-419a-b311-ba7e7a1dca99", "value": "12288:LH2VdUI4SvqMG3pa8JtVdz2P2jklJq9EhSMFv55DE/xMyZ:LH8dcSvqx3sP/omB5I/xM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617356449, "uuid": "fc07b6ff-091d-49ef-bbad-215405ffdad0", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617356449, "uuid": "c678bc23-fbf9-4207-a690-dacc06d11793", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617356449, "uuid": "44cada87-17ae-413e-b923-7d3ba908848e", "value": "Order Enquiry 200234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d745e3e1-9365-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617335117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617335117, "uuid": "3029b31b-b0fe-4bb3-bcb4-5dfa4fcf9e5e", "comment": "Malware payload", "value": "52051eaf87ca7c433a494953802d3835", "object_relation": "md5", "Tag": [ { "name": "mariotessarollo.com", "colour": "#65BC8D", "exportable": true, "hide_tag": false }, { "name": "www.sogecoenergy.com", "colour": "#460AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617335117, "uuid": "fd71a704-e268-4176-bd91-46eba8ac3cb2", "comment": "Malware payload", "value": "fc72dbb97d91ca7271e5603ca45bbbc9999bf664be39b40dada4e215c5ed6ae3", "object_relation": "sha256", "Tag": [ { "name": "mariotessarollo.com", "colour": "#65BC8D", "exportable": true, "hide_tag": false }, { "name": "www.sogecoenergy.com", "colour": "#460AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617335117, "uuid": "a9fd8d71-44a6-410f-832d-efb047ba92d0", "comment": "Malware payload", "value": "5c463258d51d801c512b8c33b90fe8f2bbb238c2", "object_relation": "sha1", "Tag": [ { "name": "mariotessarollo.com", "colour": "#65BC8D", "exportable": true, "hide_tag": false }, { "name": "www.sogecoenergy.com", "colour": "#460AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617335117, "uuid": "d76fec59-c72d-47da-a760-9a0851c13c45", "comment": "Malware payload", "value": "62d5fcd28d0dc5faf8edf899d5b09075675ab722ce44cf37cfdc36602041bf396720e84c0c4aa349ade7d5198eeb9808", "object_relation": "sha3-384", "Tag": [ { "name": "mariotessarollo.com", "colour": "#65BC8D", "exportable": true, "hide_tag": false }, { "name": "www.sogecoenergy.com", "colour": "#460AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617335117, "uuid": "beef13fe-2d63-45ea-b505-babac2227bc3", "value": "74D312123ADB95F4537CDE0673B9033CADFB7A3EA5211827A01A95DF866C265D8C1D02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617335117, "uuid": "b529ab01-e97a-4107-8f98-4397f5bedce0", "value": "3072:mCXeixUDjBBZvqfrhgoPw9CktRGdGWkB8+zXoWQuZH:msNuPcR49C2BVu+zDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617335117, "uuid": "59308e42-9934-4cb7-9b1d-c153bbf9c5b8", "value": 135232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617335117, "uuid": "1aa0f8cf-be9a-4cee-968a-c87043abf43c", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617335117, "uuid": "10d4378c-34e5-477a-a063-8b16feffee9a", "value": "ot.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89693ee8-93a1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617360756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360756, "uuid": "2a07b7f1-e25c-4730-9430-1cc5dfcbf806", "comment": "Malware payload (AgentTesla)", "value": "2a15d961c413c4e06b225e3ef4a63f87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360756, "uuid": "d87a5618-d968-4f89-95ac-d5aee66035fb", "comment": "Malware payload (AgentTesla)", "value": "fc812f21b3b1ce41b8c888ecac3c2193f96978b6b636038da8544dd051345516", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360756, "uuid": "64be9868-994e-4f6c-b7a1-f0cfdaa0645f", "comment": "Malware payload (AgentTesla)", "value": "27fd60e3cfb2ec6149196f7f309a0e1bbeb30310", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617360756, "uuid": "916df8e5-fb5e-4b39-a2fb-ce33624665c2", "comment": "Malware payload (AgentTesla)", "value": "7f24bf2bbc79d5fa5efd93315e761837af84d28f9edfca993eb9e903103d03377b911f55d61f613912f0f7497eed4fd1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360756, "uuid": "79961065-3b9b-443a-b707-8e1d4187589f", "value": "38B423A5371312081F8F493B326FF98CB5D1C2B2275C8F4AF1425E53D95367AA42869F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360756, "uuid": "cd185052-2164-4780-901a-5acf770e2724", "value": "12288:6i6HIvV2JzzQgyeTPEiYW9FBJPdo0/wLdezmAu/LO:6vH+VxgyeTPETEFDPCEwRezmAujO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617360756, "uuid": "90ba6211-9f7e-4948-b7fe-2313769e0c6c", "value": 518736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617360756, "uuid": "2be680fc-e350-4c73-aa88-41f7d3b2f27e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617360756, "uuid": "73c24449-948d-4ae7-9557-67aef7ac7020", "value": "TT Payment for Shenzen Lancer------PO-TZI-1804------------01042021.zip.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7949724d-9392-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617354287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354287, "uuid": "cb3da9e7-83e4-48e6-8ace-332c85bb9e1f", "comment": "Malware payload (AgentTesla)", "value": "a0571b1e04a6d1873c8b56815212bf88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354287, "uuid": "6398f723-4a99-41bf-8d7f-030dfdb99f57", "comment": "Malware payload (AgentTesla)", "value": "fd58c62f64d3fc76d088b22d2e2131310744cc6211ae77774611953bdfcdf1b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354287, "uuid": "4f6a9a98-290f-4287-abbf-7ae37f204993", "comment": "Malware payload (AgentTesla)", "value": "c6b387e704e11ee4b7de0073fdfa5295c9558fad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354287, "uuid": "2520e7a5-2603-4ea6-9662-6a6935e4f66a", "comment": "Malware payload (AgentTesla)", "value": "eabdc6fd575cbc17b6f8862d15d2ca8e762795ce21ed67d3ab953ba360f0254c9c310d3c4cf7a7570b7baa1552fa1e36", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354287, "uuid": "1d472232-737c-44e4-98d8-793db842f7b2", "value": "E8B423E8C0FFA55D270747B96351AB867C83DFABFD5123CB70C38886901D2B4AB542A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354287, "uuid": "3804efd7-d445-410d-bd62-1357b7423563", "value": "12288:oHQir2z5mSiR2V/vy4mMFIHKta+dvOmc6wBP0jR0qkR:8QBzcrE/NmVqt3m6wm0bR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617354287, "uuid": "009206e2-0427-4d10-819c-d51c7f709b38", "value": 521586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617354287, "uuid": "bbcfc582-cc12-42c2-b558-0548fe307fde", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354287, "uuid": "fc49dd8e-9bed-4a29-bb5d-d228f2120abf", "value": "#Contrato firmado#.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a87d21b-9392-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617354289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354289, "uuid": "d78f92fa-fd54-429f-ac1a-88da77795d85", "comment": "Malware payload (AgentTesla)", "value": "0b72dc674ac3ebd74f610011b934be3f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354289, "uuid": "a647cd9f-0514-40d9-962d-4564fb674ebc", "comment": "Malware payload (AgentTesla)", "value": "fd81870ea6455334808d4a13d1f061c24391fd607bf5a4b40f9b35ead1ab4050", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354289, "uuid": "3cbdd5ee-47c7-4336-ac3c-aeb2a3776fca", "comment": "Malware payload (AgentTesla)", "value": "5db6749c9456f9f38842d2fc9107e764b71af57d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617354289, "uuid": "56bbf5bc-409c-4353-915e-f22ca76d47cf", "comment": "Malware payload (AgentTesla)", "value": "ea5c10c8f8f5016c4df433fb304ca6bc458a5b85b350e14ef9ac354df5b760ba55b62c409e54e858537b322a53100ee3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354289, "uuid": "af172be0-be4a-42a5-8ce4-f978cbb888b4", "value": "79259D293F64658CC0AB07399464D10C9FE67DA9A9D2C2837EEE37DB6073F1307A4652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354289, "uuid": "119b6f0d-d29a-4c06-b3de-6774b0aed7c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354289, "uuid": "eabf9990-822f-4478-b5fb-4bee03dab480", "value": "12288:8ctxTz5mEgRiV/v640MF41CtI+dR+m+owFPKHR0Z:8cvTzcPQ/l0v8tJmowG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617354289, "uuid": "5aa7d481-3117-41c2-bd85-29ed6d0b1cd7", "value": 1050624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617354289, "uuid": "5e6f72d1-a28f-4003-8738-5ab1a0c7a9eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617354289, "uuid": "8715b02a-c7f9-4076-ae4c-2303acf17e31", "value": "Contrato firmado.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" } ] } }