{ "Event": { "published": true, "date": "2021-04-20", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-04-20", "timestamp": 1618963381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "8954affe-3b07-48a4-8bc6-706cd29e999b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25699c88-a1b6-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1618908924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618908924, "uuid": "d1086db6-03f7-433e-b97b-294b144fc88c", "comment": "Malware payload (NanoCore)", "value": "e76be14b99b9e3c4fae6f52b192ffcbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618908924, "uuid": "9932f2bd-0b97-4675-a006-31e1ecd1bd78", "comment": "Malware payload (NanoCore)", "value": "001eb224d4996b62715b668d313d5ca72e2461da0ce92831f74dccc88b225161", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618908924, "uuid": "01d2c650-2019-4e19-a8d5-0bdb4082979b", "comment": "Malware payload (NanoCore)", "value": "3e24fac9905079349592d918be68b4576ce8f2c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618908924, "uuid": "93da7ac9-1c8a-46d8-b862-fbfd2ed037fb", "comment": "Malware payload (NanoCore)", "value": "a00f8c7cdf9a29f7e5f2fca97a21be9dce98fdbd249c42a8360adc05a0e7f9db55cd64965e5a975028c5ebd0d09d10d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618908924, "uuid": "1ce7812b-a90f-4237-9358-c3beb770847e", "value": "0FE4013232A8DB58D4BE8B750C61634063FBB6A3E711D71D7D68015D9E63A83C712BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618908924, "uuid": "a8233b0f-7496-43cf-be2a-898b13bcf9ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618908924, "uuid": "477b1a10-5ef9-47df-932c-c765ef0c0ab1", "value": "12288:WcT4PM/EkRkynsJHqsSYKHUt9Ii5enhkAaYIo9o5lazRRRRR+:X4PMbIlSYq49IcehbaYIoOruRRRRR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618908924, "uuid": "783e9b7b-5f85-422b-9603-ccb651841911", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618908924, "uuid": "02f237ab-0133-4b8b-9146-0dd3f7a71896", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618908924, "uuid": "02c87028-718b-4207-acd4-bf2746b927b4", "value": "Order Lists.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "705a8c41-a215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618949852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949852, "uuid": "14a6f511-0c78-492a-b840-c76a11d7246b", "comment": "Malware payload (Dridex)", "value": "0f911dd6bc5076d6e07eee84559f9830", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949852, "uuid": "da8a387c-c5c9-484a-b673-2300f861fbe8", "comment": "Malware payload (Dridex)", "value": "00314a63ce8d5ddaa5ba1076f8dddfd6f52dd13a05afa600568dafb926f8185f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949852, "uuid": "32bb3dbe-cb83-456d-aa40-f39b77c2fa9a", "comment": "Malware payload (Dridex)", "value": "7151f4968e7b12f9692ff26c9040d7b1bf2524ed", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949852, "uuid": "5794be72-7d62-4591-899c-7927b634fe22", "comment": "Malware payload (Dridex)", "value": "ae6cf3fdd9e0cd332798d13960cfcd63a5d1d005404cba6670d76b3731a503b8db9a12ca771969efd5c4c76daf47a5e5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949852, "uuid": "487ae973-b98c-43c6-a5a7-d807ef25f09a", "value": "1CF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949852, "uuid": "7987fcb0-9b08-4fd9-8bf1-938ef9050238", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949852, "uuid": "47e0afbc-5546-4ccd-a671-274e9d51b331", "value": "3072:NwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:NwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618949852, "uuid": "e1d4af76-ff41-4a15-829b-901f3be63b5f", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618949852, "uuid": "27ea7e9d-2be2-4c98-a11d-cba6bbaa4d5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949852, "uuid": "ad9ac2c1-33b3-43d2-85a3-c84266545c0f", "value": "00314a63ce8d5ddaa5ba1076f8dddfd6f52dd13a05afa600568dafb926f8185f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a802b3-a220-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618954693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954693, "uuid": "2e5d9d84-da07-457d-84d7-73af3f0739f1", "comment": "Malware payload (Dridex)", "value": "20f686fe36088d08b61ebf3534b06c30", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954693, "uuid": "9731d8d1-0687-49ce-b2c1-d189e80dca16", "comment": "Malware payload (Dridex)", "value": "00475d2a2b692a280478671a1c590b9ec65a8d5b35f6ece67f29b0f5ba024ad8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954693, "uuid": "92a9469e-eb39-4b99-8e7f-b6f5160d765c", "comment": "Malware payload (Dridex)", "value": "da6d70f4a4387b9a6dbc74f94eb1a28e0946e44e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954693, "uuid": "8271fc8d-cc99-4b4a-b35e-b33dc0787670", "comment": "Malware payload (Dridex)", "value": "46fa66b4c4cedd407545d6b71936182ac774fad5d92230d5f829d37e15b53b5fefd1503c60a78cf8785475e712cb6249", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954693, "uuid": "00eeb837-5224-4593-8c50-6fcb961036db", "value": "B2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954693, "uuid": "41e4cba8-c952-4845-8cc3-3a88ab0f2ee8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954693, "uuid": "f639832f-a265-43e7-9dcd-71d251ede445", "value": "3072:mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618954693, "uuid": "1957a902-27d1-44d0-afbb-929668654c29", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618954693, "uuid": "6097ee3a-c79e-4aba-98b4-9bfcc9ed4d6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954693, "uuid": "6678da59-18bb-4d75-874c-64b887e4d305", "value": "00475d2a2b692a280478671a1c590b9ec65a8d5b35f6ece67f29b0f5ba024ad8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8571f0-a1ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618933496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618933496, "uuid": "4d3423ad-d10c-4839-88ea-8233b1ae9022", "comment": "Malware payload (Dridex)", "value": "b64b4c02aa6206d62949a1d859557545", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618933496, "uuid": "8370382a-0eb3-4583-bc21-c4117c633c75", "comment": "Malware payload (Dridex)", "value": "00574f985b3bfa7faabc30323626cc8744a72945f21b96e6171c885997a0cebe", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618933496, "uuid": "623d4f1d-24e3-4fa6-ba35-78467b644187", "comment": "Malware payload (Dridex)", "value": "4cf69bb6ba08a8426b258c551ac0642b4eebe353", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618933496, "uuid": "8ec0d8a0-e26b-4c94-9aac-e5b791a05b9f", "comment": "Malware payload (Dridex)", "value": "f496dcae220241abdfd481f13c7611a1c1e0c38afa05fe80c3e17a86cfff48d39fa08ae8a3b753d0525f91161b3bf5b0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618933496, "uuid": "9d512339-ffcb-4e61-a28c-d9782ebf1e32", "value": "C8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618933496, "uuid": "63d7db5e-571a-4043-9e7e-42ef12a69f4d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618933496, "uuid": "0efbb867-eace-43be-92e5-a15ad6d6c76d", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618933496, "uuid": "22d7efc1-66f8-4846-b29b-f9cbd2df26cb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618933496, "uuid": "4241b745-61b5-4235-83c9-b72c9d7856d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618933496, "uuid": "4a1287b0-8c09-46d8-8149-4c9d5c4bc48d", "value": "00574f985b3bfa7faabc30323626cc8744a72945f21b96e6171c885997a0cebe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261d2993-a229-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618958318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958318, "uuid": "3bdff1d3-a4d8-4e07-8a8e-cd9e679b8097", "comment": "Malware payload", "value": "c50e53a7dc2383662325ba88b7b9dbc5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958318, "uuid": "9523a8f2-1eb6-4ddd-b03d-dd096de87006", "comment": "Malware payload", "value": "0062bc9c6447cd2e34e3b2298905a607b10decb3e00740a5861429a0f03abb39", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958318, "uuid": "17aff510-3be6-4991-90a4-2e1b39755add", "comment": "Malware payload", "value": "f8d90435430f2e7d6da36ae6c35a52215df75dfa", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958318, "uuid": "573dd994-45d0-4fec-b6cc-53a3712391ea", "comment": "Malware payload", "value": "992ef72ed31117d10c4263446ae2cc1e18d1fe369b565ce52c6e83e63837622c44fc25d193564be427dc868db306f2aa", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958318, "uuid": "c7d456eb-38b0-43ce-a53c-df402d225986", "value": "D0F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958318, "uuid": "7f933b2c-0407-49e2-a489-35f5b305bc65", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958318, "uuid": "150920a9-99b0-4f7b-9fb2-df9483b5a15e", "value": "3072:KwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:KwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618958318, "uuid": "975eb612-922f-490a-aba6-b2ef51173405", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618958318, "uuid": "b9f48a8d-53ec-4324-a8ed-be7fa2318f3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958318, "uuid": "cfc2bd17-afc5-4159-844d-1bc439df4369", "value": "0062bc9c6447cd2e34e3b2298905a607b10decb3e00740a5861429a0f03abb39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03543b7b-a1c8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618916598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916598, "uuid": "56affc9e-a32a-4c3a-8806-073e47586b6f", "comment": "Malware payload", "value": "fa8c46fd1c070d274953b1f6fa9bae18", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916598, "uuid": "ab389eff-7650-42df-b500-db414b81a321", "comment": "Malware payload", "value": "00a0270dc94a751af7d639c82657d48849ed6afe182fc2c14a09fa4580a14b16", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916598, "uuid": "5bddc566-2223-48d9-8f1f-adf60c7e4d68", "comment": "Malware payload", "value": "0c0f9ccc6b439467de07a446a4edaaf66584854d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916598, "uuid": "55a759a0-a090-44d5-84b9-f34d1260f582", "comment": "Malware payload", "value": "f950a680039e5c8ddd1a02f18bef017af42952946f7e01efec60ffe366236c1bae91bef72c16df4a33d7cbaf00a97e05", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916598, "uuid": "4709a833-8f70-4000-9144-581855092798", "value": "EC739EB9B504BDD66A2E527BDF42AC9A03B52663CAC7D8C850ACB7C30333365FD12845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916598, "uuid": "bd4d9df4-dcfe-482e-92e8-e7bf3d191bd4", "value": "1536:boCSRAXSP3FRKsPu8h8WqAnl+aBqa7juTA4+hWp+E97NIOJBWo8owdlLkVsBxq:cCSqXYrKsPuQ8VAnlZBqaLQz9pBWhxkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618916598, "uuid": "4f3b5000-eb49-43b0-bca2-6e336f69b15b", "value": 79659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618916598, "uuid": "df77516e-bf17-44cb-ae6a-de5ed31852fd", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916598, "uuid": "2ded1c43-a0a0-456e-b3a0-dca960573dd5", "value": "VALVES,FITTINGS,ELBOWS PIPE BOQ_WORK_SENT KS-21010-00R1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d342e83-a206-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618943243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943243, "uuid": "101896e1-1c4d-4e1a-a649-87f9d9d83f73", "comment": "Malware payload (Dridex)", "value": "245d9bc2c9cd91016c21210d9f1466c6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943243, "uuid": "a883bdae-45bb-4434-9fd3-92be5f44baab", "comment": "Malware payload (Dridex)", "value": "00b6c0019e2587cb51a8bd27b6a27d84d06ba03397b73d2ab0db19bdafcb0bba", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943243, "uuid": "bf4fba69-a8ae-425a-99c2-8659dac94253", "comment": "Malware payload (Dridex)", "value": "1c348deb5b7631e2893488cc35909e723909bbc0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943243, "uuid": "9c63b6cc-a8da-4f53-9801-3f4800b8d3cc", "comment": "Malware payload (Dridex)", "value": "a43e69c376526758d6ef3d77258d426c018de65e7919df71e7bd4f25398a626ee0ec7fbbf09e9421979f7faf44bc280b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943243, "uuid": "797f581f-0c83-4725-91a4-b1c246f799e3", "value": "0EF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943243, "uuid": "9de46363-4b86-482e-96ee-874147a90cc9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943243, "uuid": "69f1ce2e-fb82-4ef6-8bb1-29e7a1ef416a", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618943243, "uuid": "c59bf914-75b4-49d4-920f-5f97f997b458", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618943243, "uuid": "12375128-a46e-4b27-ba15-b1688b80f573", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943243, "uuid": "c33efb66-31a1-49b1-83eb-41753cb508c6", "value": "00b6c0019e2587cb51a8bd27b6a27d84d06ba03397b73d2ab0db19bdafcb0bba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8018a6-a1c8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618916801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916801, "uuid": "f110d48a-33c0-4f96-a073-5d6d19a87a86", "comment": "Malware payload (AgentTesla)", "value": "8c45e4fc40cef1a8838d1a4e66f1b7d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916801, "uuid": "b1572071-5334-401f-8d06-e1e47cbae80c", "comment": "Malware payload (AgentTesla)", "value": "00ff9f4cde19cc7aab995fc68b8924dae19f9f03bb7d906a59a6db9d478221c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916801, "uuid": "e0505cc9-d017-4b16-a118-59696760a98e", "comment": "Malware payload (AgentTesla)", "value": "239d2057bb971a4410e3e773b448f65c0f747ae3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916801, "uuid": "1bb43a36-f119-4d7a-b1f7-0b0cd445867b", "comment": "Malware payload (AgentTesla)", "value": "46b9d88ecfef19573ce89304fc83fc96458d7e9726121b9ffbb424da44a9deb058afa01f32bb48779260cc90a3200222", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916801, "uuid": "5459ae89-148f-453a-8537-fad379401da0", "value": "58842340F71BE50BFA47943E8996FC887823EE52EA6B764F7227766450B53C8014D33A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916801, "uuid": "f42b5249-828b-4c22-9894-ebe9edad2877", "value": "6144:uIC+Z9Ld1m7eNzB/TAduFkRAAXiUaiNZ/Yl6nEUahmwWLivP2Y2ZqPXj5F:VC+HXfNz1AdYk+inZ/JuhRWuvPTT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618916801, "uuid": "4946a0f7-3758-47f9-a087-5f40860ee984", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618916801, "uuid": "f7db6fdc-70fe-4844-ab5b-a0876cb2ceb6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916801, "uuid": "94e2dfb7-8400-405b-9274-74e1fcad0179", "value": "Wire Payment copy35,276.70 20-04-21.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522c3e46-a220-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618954526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954526, "uuid": "6818813a-22ff-4382-bf5d-14ef8977a4e1", "comment": "Malware payload (Dridex)", "value": "b1f02e2747e9e2b730503775684f26c5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954526, "uuid": "c1744e18-7075-4fe3-93cc-a8f38a34ee56", "comment": "Malware payload (Dridex)", "value": "01028579346a0992b86919631bfb96f8befa3431cc8d78c701e57d0642293cfd", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954526, "uuid": "7999d865-09be-4477-9e16-a2963e8f26d7", "comment": "Malware payload (Dridex)", "value": "1e6546db5617c6ad2e2850cc594fec3007043fa7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954526, "uuid": "286e97c5-a26a-49a0-ba99-6148b3042785", "comment": "Malware payload (Dridex)", "value": "d54e683d4dd25dffc931dc3ebd1274083295b978fd7d9f7309428fcbc0957c6a846759fa47993da5fae83bd4a5d622a4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954526, "uuid": "7938f022-edd2-4ad7-b523-9a4e7400fbb8", "value": "50F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954526, "uuid": "fdd0a1a7-7812-4243-841f-f6e28da14707", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954526, "uuid": "8260e019-8059-43fc-ba13-b41188f64952", "value": "3072:dwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:dwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618954526, "uuid": "053f4624-1c53-40b7-bc8a-c236a27fe67b", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618954526, "uuid": "96ad0496-3830-4a06-a5cb-b1b7cf3a2143", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954526, "uuid": "22283bf3-6bb9-4d10-950b-d524b5a9822a", "value": "01028579346a0992b86919631bfb96f8befa3431cc8d78c701e57d0642293cfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b99e00d-a175-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618881205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618881205, "uuid": "12d3e846-b675-423b-a93a-222a0b9ec1a7", "comment": "Malware payload (Dridex)", "value": "b8dfa0478eafad5ce7801677405021bc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618881205, "uuid": "1223e6f8-bb0a-44de-9505-ca0fbe8e723d", "comment": "Malware payload (Dridex)", "value": "010f962699a18e6d70e147782efee5bcc20cc23b56c3526987643925c05ca039", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618881205, "uuid": "9b3c9af3-732a-4bb3-9a66-0cab2d58ba26", "comment": "Malware payload (Dridex)", "value": "87d5b1522a4af4ace3371e0b7bb64e4290bb36cc", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618881205, "uuid": "0afab6c7-cee6-4ac9-809e-11ef157efd7d", "comment": "Malware payload (Dridex)", "value": "8cf89756e2c5d8acc0c1df1ba4369f8c3c4c1dfb7125134c350f4b3a31a7268576f16669768b7db251a4727a49249fba", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618881205, "uuid": "46e1d6ac-8d2b-4cbf-bf96-08f0c9993949", "value": "7BF3D088CBB3E4E6EFB3937866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618881205, "uuid": "d6f5b34c-fa6a-487b-a8e1-c2e81ad52737", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618881205, "uuid": "a755327b-1ca6-4eeb-920e-c868cb1e537a", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618881205, "uuid": "6c5cd735-b226-478f-83a4-362476d3f89a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618881205, "uuid": "a0cabae8-03b9-4158-ab5b-0810ae975505", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618881205, "uuid": "3f7d5435-4fc6-45fc-bbec-ef3b4fe06b96", "value": "010f962699a18e6d70e147782efee5bcc20cc23b56c3526987643925c05ca039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb978e9-a20e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618946759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946759, "uuid": "175fb8a3-5b05-483d-a3d6-be60c862e087", "comment": "Malware payload (Dridex)", "value": "a8f7d57c38b436c9151e6021f95dcb42", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946759, "uuid": "4deec09f-9b1d-4380-b52c-c38bfadef814", "comment": "Malware payload (Dridex)", "value": "0118148e136e6e5045d4dce97e2201e417a1ef1913f6c930eb32ed42de57fcac", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946759, "uuid": "cd934003-8ef2-4984-b810-c401381659c9", "comment": "Malware payload (Dridex)", "value": "9de046261b901fcde8cd3f4b65c87ab6d4c9381b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946759, "uuid": "27191037-04a2-4645-97a6-1a12ccc99266", "comment": "Malware payload (Dridex)", "value": "9af3b51dfb3a969112ac77962fbb69d6bbf31d1f0ce20da26a296a1ce1e0fe84540099f6ad59b6ec9a4a451646f90b42", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946759, "uuid": "032d3fed-0416-4ac6-a7cf-ac7cef0a0ff5", "value": "F3F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946759, "uuid": "f595e849-896b-4bcf-af8d-b40282146848", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946759, "uuid": "466f7763-643c-4ed1-9f94-ef2ca347e4ac", "value": "3072:qwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:qwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618946759, "uuid": "f2a3702f-646a-4476-b040-8b1805784b83", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618946759, "uuid": "49f23ea2-2f90-4027-be38-89a2828d3c81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946759, "uuid": "45d98fc7-9c4b-4ea5-85b2-22bfa2d9ac0f", "value": "0118148e136e6e5045d4dce97e2201e417a1ef1913f6c930eb32ed42de57fcac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1072b0f0-a21b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618952268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952268, "uuid": "99b78b0e-4cf2-4e21-aa49-28d5a42897d7", "comment": "Malware payload (Dridex)", "value": "0df8c2f85d38ca1aaef18b2ceec0aa73", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952268, "uuid": "f9008b12-a06a-4061-9f79-ccd2e3ebecc0", "comment": "Malware payload (Dridex)", "value": "0169a4028da14dd962e1986eb7370c22bcc5cd9fe28165de3efcc4360bc0bdd5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952268, "uuid": "ba3b477f-d812-4d06-a50f-1e3080f0ee12", "comment": "Malware payload (Dridex)", "value": "68290f6898171d537d32b8d319ce59757114e27b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952268, "uuid": "df31317f-e5c4-4db0-9c19-a0a878b7fc72", "comment": "Malware payload (Dridex)", "value": "fca003fb04ae86f22f48cbdbf1e57b2d889111d019c889be3d457f251592d567ac3bae25b1dc754b7d661a8c6eb0b96e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952268, "uuid": "8bc08a4f-62a7-44df-ad08-8478cf7f77cc", "value": "EBF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952268, "uuid": "6b0aaf79-48e7-402a-b252-49f15b243552", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952268, "uuid": "233f5df8-b6a6-4364-a559-761fad0ff940", "value": "3072:IwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:IwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618952268, "uuid": "4f1aebc1-0e4e-4adf-9db4-50065002b1f5", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618952268, "uuid": "b4cf08f7-18a7-43d3-a6a4-d3611065646a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952268, "uuid": "85cf3535-7114-4a3b-b647-933ff9c785e3", "value": "0169a4028da14dd962e1986eb7370c22bcc5cd9fe28165de3efcc4360bc0bdd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12c9544-a233-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618962819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962819, "uuid": "6c7c1e07-8b38-4510-80dc-e8c9fd857be1", "comment": "Malware payload", "value": "95d363da878b697cd49581a1b715baf3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962819, "uuid": "8462d252-1ca2-4762-adf7-5cb042c28e6a", "comment": "Malware payload", "value": "01a178c1bee29196f762676258190a6d8fa0cce0b9d593a00b08b4204260eef4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962819, "uuid": "0f724322-4bc2-444c-9926-3931f382defb", "comment": "Malware payload", "value": "b369ac5c9b4aa50894194c23f088502a69c979e4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962819, "uuid": "df238e2c-1c40-4b2b-a5f9-eaab1813d848", "comment": "Malware payload", "value": "5dbe8a51fad252f6382a20451e75d7a9af4e60f5ca9687c968ba7774862dcb19215616460349e7cc0b8b97e4134c1dfc", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962819, "uuid": "0c35c49b-0fdb-49b5-a007-26c2c6d4d249", "value": "59F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962819, "uuid": "73bcd6b7-9c8e-4af3-b69b-f574f261ac05", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962819, "uuid": "a1194d1b-c986-482e-ab58-7c827f06d010", "value": "3072:pwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:pwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618962819, "uuid": "e3617d8c-0e36-4441-aa56-1cfb355ef1d2", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618962819, "uuid": "a2bd2a93-adf5-4b73-ba07-9df396fcc076", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962819, "uuid": "8218e4dd-a8e9-43f6-b67c-1a06b93c4874", "value": "01a178c1bee29196f762676258190a6d8fa0cce0b9d593a00b08b4204260eef4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd8cbcc-a1ff-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618940478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940478, "uuid": "8833a756-f05f-41d9-a71f-1eda733ab366", "comment": "Malware payload (Dridex)", "value": "97307586220c331ce1b5b96de566fe08", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940478, "uuid": "9954ab58-d947-4565-9664-2948b2e4426d", "comment": "Malware payload (Dridex)", "value": "0207e07800ef1bcded9c0d60eb1e120de2245bd717f3abc62ae5f01a625cd795", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940478, "uuid": "02573a1e-5e59-45bb-a1cb-cffb7a6db7cf", "comment": "Malware payload (Dridex)", "value": "271d92ebe7eb4678eec16599cecafa9b3e802685", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940478, "uuid": "c3b00836-17c3-407c-a687-c971aa88b1c4", "comment": "Malware payload (Dridex)", "value": "57b91bc9efa2072870ca4037d3ae8a3339922590653187f59154437e92e7d87d90377e660d114aa47d1c0c02e4eeb113", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940478, "uuid": "65db6203-d811-4358-8e55-7e4a41babfa4", "value": "CBF3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940478, "uuid": "4bceed5c-7d53-4b49-ac6c-c2e43c4ed0bb", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940478, "uuid": "1e9967f8-f9a3-4fe2-b8af-7155ffc1cf83", "value": "3072:XwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:XwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618940478, "uuid": "14d0c926-af1a-4c7e-9e07-97172a78c209", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618940478, "uuid": "e442a981-6ed7-4e13-93e3-da02ce3be3b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940478, "uuid": "23391161-2f46-4459-b5ed-50007834b622", "value": "0207e07800ef1bcded9c0d60eb1e120de2245bd717f3abc62ae5f01a625cd795", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8bd66b-a200-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618940716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940716, "uuid": "9d69d273-8212-48a8-8927-42173b5c431d", "comment": "Malware payload (Dridex)", "value": "8a1deb676b82e1b099da2a22ed8254d2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940716, "uuid": "08ff9771-88d2-4af5-99ef-1bfa6de2f37d", "comment": "Malware payload (Dridex)", "value": "025a27a49de265b1167c2e8b43d83535a0855dce63bebd2a1bf417379457fe41", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940716, "uuid": "d0d6cb76-ad62-49bd-9eb7-7280a3e20815", "comment": "Malware payload (Dridex)", "value": "040ba390d785db24b969d8f1e3acfe6a3bbbf57a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940716, "uuid": "ef27aef6-5604-46fc-a2b2-719ed6a921ba", "comment": "Malware payload (Dridex)", "value": "8a1bf9b21dfbf60ee3db3d8531a920fcec36a26eaf09bdc4d95b1296e96e5c1468a697fed214a2e3c51916c834c8f0e3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940716, "uuid": "39523905-485c-4117-a245-6d6f12fd6e8a", "value": "B0F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940716, "uuid": "6ff9b323-a5b3-4db8-8b37-5994f1acf14b", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940716, "uuid": "8e6053d7-5537-42b2-b45c-cdf721bc8305", "value": "3072:5wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:5wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618940716, "uuid": "eaee4d08-ba2f-461d-98bb-56012604a9ff", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618940716, "uuid": "bf731e0b-29b7-488d-8c98-02b959f8a446", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940716, "uuid": "3a14e7a4-ea40-4b8f-82cb-a496fdc39ce8", "value": "025a27a49de265b1167c2e8b43d83535a0855dce63bebd2a1bf417379457fe41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3207855a-a207-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618943735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943735, "uuid": "0e53f10c-d701-4cd9-aa9f-b078abaf66a1", "comment": "Malware payload (Dridex)", "value": "701dc4e2ce28a91b6343307e4c1067f4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943735, "uuid": "b83e281a-074d-49e1-8923-59a44a9c500a", "comment": "Malware payload (Dridex)", "value": "02651b681e4b05d103aec3cdaaec7bea5cea08231e30dca26c6a95b38624c6e6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943735, "uuid": "7eac8142-e9a5-4c7c-9832-4ad78ccc2a82", "comment": "Malware payload (Dridex)", "value": "3d5f7d3b16ef896a99f0b14dab5e568e019ab230", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943735, "uuid": "cb4c194a-5d58-4878-8c7a-7135d80ba976", "comment": "Malware payload (Dridex)", "value": "55a93908fb6ba13dabeaffe6d79b1236ebf6400972627e463d81e56fd3e47dcc9c9a8cacb4dc7aff36164bcbf52f0e12", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943735, "uuid": "ab312a74-7b72-4f89-a359-418595063e49", "value": "E0F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943735, "uuid": "e5e0c712-db9d-4902-a724-cc0392b61f94", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943735, "uuid": "fa253159-5fa9-4ca4-a17b-61f7878eb061", "value": "3072:OwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:OwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618943735, "uuid": "9afcd869-84d3-4e30-9b43-9e9c0a6e6705", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618943735, "uuid": "e57dffbc-8e10-4eea-ba36-2d1bc349c673", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943735, "uuid": "aa929e0a-88fb-40cb-aeac-6a4756424b7e", "value": "02651b681e4b05d103aec3cdaaec7bea5cea08231e30dca26c6a95b38624c6e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c843612-a211-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948208, "uuid": "c9b083b4-d8b5-431a-bc28-d77ec2f4edd0", "comment": "Malware payload (Dridex)", "value": "376472c93d3b6a32daf5379c2425f21e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948208, "uuid": "73ab8fe6-a97d-4faf-a137-cd2317254b28", "comment": "Malware payload (Dridex)", "value": "028010d03d9dd075f36a08cea1a3572b0fb4e3384d55335f7896a18ce0a27fc9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948208, "uuid": "d8441055-b8a6-4507-8d90-e5f2bf234d3c", "comment": "Malware payload (Dridex)", "value": "68849ad1b011952984eb23ae4347724312ebbb87", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948208, "uuid": "19cfedea-6105-4936-a342-434bd998ea61", "comment": "Malware payload (Dridex)", "value": "bf793e0a62db19b9f0a98454793a94f54184697a03d555c92218a6c612ec00866894cf6886a3fbd3c27f00bfa79e76cb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948208, "uuid": "cd813e22-30e5-4c82-9218-8355a35b3616", "value": "8FF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948208, "uuid": "3651da48-98a2-4807-bc67-619665c5fe59", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948208, "uuid": "450c6317-83d2-4e9a-83ca-bd104add0543", "value": "3072:ewZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:ewZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948208, "uuid": "d7ce4f0f-7713-4040-a551-3500b17c8f75", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948208, "uuid": "36b3b233-0c6d-4715-8188-56453cc92fa2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948208, "uuid": "71a32e38-1df6-411e-b7f6-872abd876411", "value": "028010d03d9dd075f36a08cea1a3572b0fb4e3384d55335f7896a18ce0a27fc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ceb97c-a1d8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618923691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618923691, "uuid": "ca521184-ce7e-4fc3-b67a-b4f10e078dbf", "comment": "Malware payload", "value": "a4326b69873c799207e4c9d30c2ed3ac", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618923691, "uuid": "98f6f6db-7b2f-47ef-aace-d8a81856e16d", "comment": "Malware payload", "value": "0299ed3db28516997c3a162def5ee464a25485241b4eb8cf2a0d3f21fd498f72", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618923691, "uuid": "38fd7150-c7fe-4099-91e7-0894fad96653", "comment": "Malware payload", "value": "ee9d604c54a4450a6bfa071a2f23aaae5114e680", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618923691, "uuid": "e9a26ffe-b178-477c-8e08-688935fefc38", "comment": "Malware payload", "value": "60bc2adedb70399650533baf7e80b24861e3a90f709be1474eff9c2bdffaa611d9e1c70e8205d133e2b64f765b596147", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618923691, "uuid": "9e5d7b82-398c-433a-99ac-03fe3785ed2f", "value": "E23401042555C270DA22C470E8A1617182B06D1FAA66CB8ED94D7F3F793A39DFC2127E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618923691, "uuid": "231f0653-229f-407e-8b99-ae4870755b0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618923691, "uuid": "8d361c3b-c586-4ffd-98ff-ff39d16fe8b6", "value": "6144:EkleFpw2X0T1bOB9fLbk72DqZjDYSMRZqVH668MQ:1EjXKiVbk7wqZjDYB/qVH668", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618923691, "uuid": "b1081027-0415-4731-a025-f8f5799fad4f", "value": 251392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618923691, "uuid": "7280d29b-3e58-4972-80e8-30b7f6678d66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618923691, "uuid": "0c4f9f37-7748-45b3-9cf2-e38ffd60d9fd", "value": "SecuriteInfo.com.Variant.Bulz.440290.18036.1686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995d791d-a198-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618896234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618896234, "uuid": "5b187d03-10ac-4ec5-9263-0083538af53c", "comment": "Malware payload (Dridex)", "value": "04529ba8ba7d4df7f95f35ca602e6ee1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618896234, "uuid": "dd051f02-b3d0-49d9-8903-2d8b357a9581", "comment": "Malware payload (Dridex)", "value": "02ba025ccaa3e58bb7268674c2dda5b22e45cbebae4e89d5c52caf5b45dadd3c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618896234, "uuid": "aeca176a-e5d2-477a-b06f-d47b6984f29d", "comment": "Malware payload (Dridex)", "value": "cc5290adfeb76dd8795de40e463cd72745041faa", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618896234, "uuid": "fcf7da86-2014-4ad4-aead-8076f079fad7", "comment": "Malware payload (Dridex)", "value": "59193ca1890ab19465e494091cfc0e3ffb8d5058d0d5084c19c8cd0aa0c089dd05abdcf58f542429b17082398610acd1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618896234, "uuid": "26fb6709-2c8e-49b4-a9a2-23951194704f", "value": "CEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618896234, "uuid": "5cabc8f3-07c2-487a-92a3-9a73e0112d47", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618896234, "uuid": "54cb27ab-4e9c-449e-bcfb-6bbe8aa48ccc", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618896234, "uuid": "ddcebdbf-a112-446b-b997-c2e0c01e1db2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618896234, "uuid": "9f27e2c8-ab7d-4c99-bd70-b461f9da7ea0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618896234, "uuid": "f221cc5a-9b00-4e2d-bf51-c12f3949896f", "value": "02ba025ccaa3e58bb7268674c2dda5b22e45cbebae4e89d5c52caf5b45dadd3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18221c4d-a22b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618959153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959153, "uuid": "4eeeba21-7de3-4c67-93e7-afa99906ec8e", "comment": "Malware payload", "value": "9dab04d493855bf62aa8f30228aa926e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959153, "uuid": "3cc2bced-612a-44ab-92e4-70b015ac2214", "comment": "Malware payload", "value": "03433ead9ac6b92a6b5319f2c44f81e0f424bb8da45dd6a8d7dd04379d698530", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959153, "uuid": "4df3f33c-9c3c-49b1-aa1d-90d815e6c675", "comment": "Malware payload", "value": "00f759f0e3d06c44c714c23c0f109ab2418b1bc1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959153, "uuid": "a265f77c-8821-49d2-bd2b-356d6de879e4", "comment": "Malware payload", "value": "56e6b60a8b7e9371d50e7c772d596199fd988f643484fab1b87d753dc92419196e57f2529f8263fe5dc8a3218decc882", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959153, "uuid": "7bbb3aae-200f-41b2-9896-5e1c5ef8cb4f", "value": "1CF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959153, "uuid": "7e8be9a1-5232-4fce-92b8-bd4601b3ee93", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959153, "uuid": "aa6e8539-a6a4-4888-bfc0-4880c6c9c319", "value": "3072:8wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:8wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618959153, "uuid": "924fd7f7-fb7e-4934-a1db-8daad268004b", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618959153, "uuid": "4912ebd9-9373-402e-93c0-dbea28313883", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959153, "uuid": "f184d67a-0f1e-423c-99d2-4664a2d4a254", "value": "03433ead9ac6b92a6b5319f2c44f81e0f424bb8da45dd6a8d7dd04379d698530", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb49ae53-a19d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618898438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898438, "uuid": "5b001575-c030-4ff2-9dcd-fda6fcb12a66", "comment": "Malware payload (Formbook)", "value": "920ee3d40083833959f5a40f068e46ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898438, "uuid": "9bcaa72d-2653-40c2-bfba-b737d93d1baf", "comment": "Malware payload (Formbook)", "value": "035c33a60853bf5ee2b470e1c7d0e00a23d13a6b4d19afb46d6fe2335b468a16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898438, "uuid": "cd0ed51b-04b2-49e4-a108-65a77c5f40e0", "comment": "Malware payload (Formbook)", "value": "4721a8a6723c31cac8a4a49b6ad6fdcd1d0c6280", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898438, "uuid": "e65404ac-afd7-4d24-83e4-f9b282f02543", "comment": "Malware payload (Formbook)", "value": "77113a33391141fd232e12fbc9ec6acc7c1a668c2f1c59e6ee31b0f523cdee8c9d99bf9718c5e9e747bcdb3b16a914f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898438, "uuid": "82d8f635-3d34-4771-a2e7-c2f43ccf3859", "value": "94256B5C725075DEDA9BD2758BA49C64EB503C77430B820BE02735BAA93CC87DF160BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898438, "uuid": "6ab5c3e5-aa4f-4560-9c84-8a636d612968", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898438, "uuid": "e108478d-7b1f-420c-8dcf-1b19ebc05b3b", "value": "24576:l5kQJeakIWx+CaZshNKxqRRRRRGt/DteVauy:QQ3DCaehNpRRRRRGHeVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618898438, "uuid": "73becc8a-835a-487f-b99d-a750fbe6e9b5", "value": 972288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618898438, "uuid": "ce796373-5a9e-4af5-842a-2970ca79b502", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898438, "uuid": "5dc591e7-02de-4b6e-b36a-f8c74a14c327", "value": "PRrWYAIHW9DNMIh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da1beb49-a1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618928555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618928555, "uuid": "b3fc6e1e-5382-40d3-a0d4-5d9bee3af9a6", "comment": "Malware payload (Dridex)", "value": "2f66261039bbe834205093c2d4550dcd", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618928555, "uuid": "c33694c1-1019-409f-9e04-32427e459c33", "comment": "Malware payload (Dridex)", "value": "037ef4dee713ab7329bf47829b1b1020bdc33087b827fb70f2021caa3bba9eeb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618928555, "uuid": "f64744a8-2d70-4f32-9960-918b4aac7663", "comment": "Malware payload (Dridex)", "value": "507e2c8ad0d04c3510c719758afb2cd08b081140", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618928555, "uuid": "5ab4786f-a8c0-4b0e-9e79-907f3d5959a7", "comment": "Malware payload (Dridex)", "value": "326d215d88e28fb2a0915acfe0878b5c0e12e6583c8b371e539095b0e04fba48c421f0d7c6e67df5d74c1da21734a993", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618928555, "uuid": "7e79c870-a3b3-4c56-8608-066696b0fd70", "value": "A7F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618928555, "uuid": "fd20c9cd-7eff-481f-b3a3-45531e18b022", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618928555, "uuid": "94bed2ad-7968-44be-b926-d842c1ea12c3", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618928555, "uuid": "10569b0b-94dc-4aaa-b866-04206452e6eb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618928555, "uuid": "7064de34-9e8d-4d12-865c-da585a0b40dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618928555, "uuid": "77abd6cd-784f-47aa-9955-22988219f3af", "value": "037ef4dee713ab7329bf47829b1b1020bdc33087b827fb70f2021caa3bba9eeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae57fbcb-a1a6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618902282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618902282, "uuid": "f3663a44-0c2e-427d-b1f5-309e4f8eb14e", "comment": "Malware payload (Dridex)", "value": "2230f81e4bd050c3e470fb11263975a9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618902282, "uuid": "3f9323b5-6fd2-4c24-ad41-a4d1fb4cc0d5", "comment": "Malware payload (Dridex)", "value": "0386a7ba03a907fda163cd442c2d71eb71499b42f2fea09a9bd97341b3b930ed", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618902282, "uuid": "eabae9cc-c49c-4ce0-8618-549bf8eacca7", "comment": "Malware payload (Dridex)", "value": "ca8a9628c8571d12aa0df0b260f474d064cc5e05", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618902282, "uuid": "8e9e1ffd-bea9-4c0b-8634-82990bd658b6", "comment": "Malware payload (Dridex)", "value": "b8d9318872946fabcec9cbd2fc6fef0e7552b4345f8135281fb3b6c3fbf5380c8fe6c06639ff8e465971b722ce90a907", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618902282, "uuid": "e13d0b8b-ac1a-4c8c-997d-04a693034e0e", "value": "D1F3D088CBB3E4E6EFB3D37966F85E1B4A1574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618902282, "uuid": "859030e0-4d23-44cd-84e7-803c6d24047a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618902282, "uuid": "0dc2e80f-44d6-4cc9-bf24-32fe420a6b20", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618902282, "uuid": "7f74ec58-840f-4446-afb8-6174568d287e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618902282, "uuid": "62140a5e-dd43-44e6-accb-ca87deaa5432", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618902282, "uuid": "1060e164-a4e6-4687-9e7d-3cb0675a0d1b", "value": "0386a7ba03a907fda163cd442c2d71eb71499b42f2fea09a9bd97341b3b930ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649f23c5-a1e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618930935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618930935, "uuid": "5d092686-22a8-4add-bf7a-8f8a9f740c89", "comment": "Malware payload (Dridex)", "value": "ed2962285bd075dc6d37cb41cdfe93cb", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618930935, "uuid": "efbfe973-fbf2-4f9b-b167-548c3c664759", "comment": "Malware payload (Dridex)", "value": "03b139b3b0df772d819190f5153d23c2e448e95dd29e28fa381347af9a7d4894", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618930935, "uuid": "e904018e-dd40-4f78-be18-d99ffd230252", "comment": "Malware payload (Dridex)", "value": "eff39fba0cdbad89a8970c485e22d5735bdace85", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618930935, "uuid": "7558b64b-e372-43cf-880f-e3de5008f841", "comment": "Malware payload (Dridex)", "value": "7a3e6d684c14c8b62835686d2c87ffd86e470abc9e3562a8f71b042ad34536db0b0f59c6af64b1e5946625225ff4eccd", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618930935, "uuid": "b4eb80e3-0bf2-44ef-8695-b9038ea1783c", "value": "A3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618930935, "uuid": "4bbe2eb2-9d94-425a-b228-28fbe7ea60ed", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618930935, "uuid": "07874e23-0de1-4495-b4d2-c120d36febec", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618930935, "uuid": "e122a09e-042c-4e01-8078-f8f26ef1d0b8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618930935, "uuid": "f4470f88-0d56-4a35-bd53-ab4de509f57a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618930935, "uuid": "a0ff5b1e-59e3-4e71-a3e8-0d2b0d058bb1", "value": "03b139b3b0df772d819190f5153d23c2e448e95dd29e28fa381347af9a7d4894", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ddbdef-a1c3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618914618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618914618, "uuid": "0d6970a9-bef4-4736-b907-475b6443a70c", "comment": "Malware payload (Dridex)", "value": "37e1df0dcd5bd48f8a5b231d8b750353", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618914618, "uuid": "9be5c2d6-7d9b-4d4c-be3b-0ef4d4dba81c", "comment": "Malware payload (Dridex)", "value": "03c36a9907a05fd74d29deae9bcd9ab28ad11d3a38e7e36ccc538be0c6b97cd3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618914618, "uuid": "ff168257-2527-4629-8cf2-ea94263158f9", "comment": "Malware payload (Dridex)", "value": "215f52442a361c139c2fc9f5c86765d90a26a37c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618914618, "uuid": "85df6ab6-eda8-4e96-8204-8e54ee649c75", "comment": "Malware payload (Dridex)", "value": "a56171bdfd5b98d8719022f0adb27d539adbde2e134a03c08bf7691015bf28e8fb5af54a5bf86c22a17e9cfd4456a094", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618914618, "uuid": "806b39fb-3e6b-4bb6-b651-5fa53c5d8c59", "value": "6CF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618914618, "uuid": "611e8bf0-165c-4f78-a5e3-50e6126f4f19", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618914618, "uuid": "33a8e02c-e146-493a-b8af-372a3c6b4f32", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618914618, "uuid": "784cf6ed-4fcb-4dde-bb9f-8895233032e4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618914618, "uuid": "5cae4a6f-5c51-4279-bdf2-f0b9e3c1837b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618914618, "uuid": "c58df6c3-9a25-4fcd-927c-620638880fb7", "value": "03c36a9907a05fd74d29deae9bcd9ab28ad11d3a38e7e36ccc538be0c6b97cd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a06547-a20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618946444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946444, "uuid": "e1df9a7b-140b-4729-8d75-7668135e6fc8", "comment": "Malware payload (Dridex)", "value": "e6700742296b82c088f2321edef1c74f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946444, "uuid": "d691a04d-edaf-4470-8b85-e81c46282d6e", "comment": "Malware payload (Dridex)", "value": "03e458bec99e5c5f513119a5a65b0f4db119472da985652cfcafe9f5d7d7b1df", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946444, "uuid": "5a70238c-32cf-4e38-a1f9-0834c18d7d0b", "comment": "Malware payload (Dridex)", "value": "cf690c22144aa4edba8929cd47896643416eb8c5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946444, "uuid": "280d462e-6403-46ea-8264-a0f1dcde6b17", "comment": "Malware payload (Dridex)", "value": "3c7b21cbe27b2fcaffb50d958f5c46ba25adedd0898ba6f32c2f63afefa50c7433bae7678f303481fe8bb7686956adfe", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946444, "uuid": "1c327e0d-9e60-415b-85fa-bfbd6f361c90", "value": "87F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946444, "uuid": "b579c6f6-1540-4100-a601-a939f6dce077", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946444, "uuid": "f73f05e3-bad1-493c-9001-5e00baa825cb", "value": "3072:/wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:/wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618946444, "uuid": "12e38ecf-0569-49cd-b0d9-832e6787de2e", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618946444, "uuid": "074d59c8-2d3f-4f64-85c4-71d420709e0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946444, "uuid": "9ebeabec-ef28-4e64-bd8b-54ea0fc4ba17", "value": "03e458bec99e5c5f513119a5a65b0f4db119472da985652cfcafe9f5d7d7b1df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae96843-a212-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948501, "uuid": "944d182d-284a-4b36-9d1a-6f57cad6d8ef", "comment": "Malware payload (Dridex)", "value": "8dd97353f3c8547a775cb3ecd05ebbfb", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948501, "uuid": "bc238f7a-17ee-4eca-8453-6384a1719f4e", "comment": "Malware payload (Dridex)", "value": "0423dfa4b2a1f26432d4cd106b6191cf192ca214b1fac7120e32a46855e8aafd", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948501, "uuid": "9d6e37ae-e7d0-4e97-b09f-f615cd40653f", "comment": "Malware payload (Dridex)", "value": "c4f181b6fbf7f79780c819878ba2d4dbe2859133", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948501, "uuid": "d9f1b67e-10c2-46ea-9a5a-53734d5db485", "comment": "Malware payload (Dridex)", "value": "2311a48d4fd29ccbfe9e8d830283b1e384cddd755a1ba86ba04307cab66b6c4ae9ff3a8b216df1abe3e02dcf70c46d78", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948501, "uuid": "4a343a01-866b-49ef-b5b4-99e6720b6e4f", "value": "6FF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948501, "uuid": "04b66bbe-73a9-4ba6-bde5-bf09b55610d3", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948501, "uuid": "7c11527c-6698-452b-a48a-bfb12b376f93", "value": "3072:fwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:fwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948501, "uuid": "d75f9e1b-354d-431e-a679-8f650aaeaf6c", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948501, "uuid": "c7c8ba00-f3d4-4195-ac70-1569d2b2b848", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948501, "uuid": "9ea9abd2-8955-4a38-9fa6-607ae79488f4", "value": "0423dfa4b2a1f26432d4cd106b6191cf192ca214b1fac7120e32a46855e8aafd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e20c9cf-a228-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618957848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957848, "uuid": "879c53dd-b608-4062-95d0-c391e7ea91fa", "comment": "Malware payload", "value": "79ce8a0487808630affb8bfda502b621", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957848, "uuid": "6e806e7e-7eda-43ea-93e8-edb3177888f8", "comment": "Malware payload", "value": "04522397b52e4f5eea5089a2e1aeb8390aec492525a21b8fd39afc4fc2448ab3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957848, "uuid": "0788e478-f9b4-4f91-aa73-05c40bd1cceb", "comment": "Malware payload", "value": "188e807c1309a1b5d6867c53fb592788fc3c6a6f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957848, "uuid": "97ac38d2-d30a-4476-9e96-abb0cd74a9ae", "comment": "Malware payload", "value": "ad8b4d3cf142761cda256af31b8692425b4bbf69804b4e4802abb5a17112c68a9e18cd2a5c637f1b0c4bec9a3358db60", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957848, "uuid": "d6818ac8-3895-4214-908c-a6e1ccc864ae", "value": "46F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957848, "uuid": "a3299c65-edf2-4fc5-8f86-a8c324b57934", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957848, "uuid": "35801aa5-8c03-4348-a3cf-b33b60679b1a", "value": "3072:vwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:vwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618957848, "uuid": "68ea2198-926c-44dd-95ac-8f2acb565669", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618957848, "uuid": "117859ee-604a-489b-b1a6-b234d695ac34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957848, "uuid": "9ff84feb-3664-4ac5-b364-0d0a052dc844", "value": "04522397b52e4f5eea5089a2e1aeb8390aec492525a21b8fd39afc4fc2448ab3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01227c29-a1ff-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618940217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940217, "uuid": "d2cb644f-903f-4c54-b24c-dbc2d951608d", "comment": "Malware payload (Dridex)", "value": "6986bc14049ab447b5ab12edf4f4276e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940217, "uuid": "7d098232-0f22-499d-ad5e-bd1c63064e03", "comment": "Malware payload (Dridex)", "value": "048d34a4dfd8108424d5d443153c772f26943ddd103118f9182f8f484880168c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940217, "uuid": "c120642e-d306-49ac-bf3e-4fddd8b3876d", "comment": "Malware payload (Dridex)", "value": "a3e5a6f09f6d98d3c6433a88a10ba3c8c94a62e7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940217, "uuid": "f2cfaa1d-ce46-4dfc-8fd5-04e63c6209aa", "comment": "Malware payload (Dridex)", "value": "31553efddab1b08b074d923469ab29916bd13a09b73446764e58825788124168e920ed5d9fcb76d2ffa0fb186a3e84b6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940217, "uuid": "635c8525-8f70-42a7-8963-ca13433b26f9", "value": "1AF3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940217, "uuid": "16aaf371-57af-4b85-86bd-bc4c8d36fc60", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940217, "uuid": "a31d7ef0-ef4c-4b89-9aa4-ab9f5c747813", "value": "3072:WwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:WwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618940217, "uuid": "48840491-7f0f-4165-bac0-b5e9c3232d11", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618940217, "uuid": "0636ef5e-00a1-42bd-aa4b-b8e0bb4d2bf5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940217, "uuid": "87b02164-4d05-4d3d-a90a-ad487adf5366", "value": "048d34a4dfd8108424d5d443153c772f26943ddd103118f9182f8f484880168c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16747aa2-a16d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618877546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877546, "uuid": "05d05191-aeb2-4678-9dbf-7320750fd361", "comment": "Malware payload (Dridex)", "value": "f03d1909b8380cd1419bac1113833184", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877546, "uuid": "5604ee36-77e4-4c8d-b4ce-4cd7d5610c92", "comment": "Malware payload (Dridex)", "value": "04a0f313f4f8a273dfc009293d9e81d72699b080e11aa611e16c3a74e4cfaad4", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877546, "uuid": "f2bbd9f5-0972-4e7f-a8c3-49eb7d96f986", "comment": "Malware payload (Dridex)", "value": "d9af3d4429d256e1f2c43cc018f837ea2224899a", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877546, "uuid": "5b9d96f6-f852-4608-9207-e61b986c0d5d", "comment": "Malware payload (Dridex)", "value": "b0382864d9c8d23a5f29b90e57613967f11579a2e86da3a86897566a145ea3c9d25e751739016d7b59af41bf0f5cc57b", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877546, "uuid": "12217e5f-c4be-4ca6-899e-069086cf2c4f", "value": "DDF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877546, "uuid": "fb11a49f-7d0a-40ff-b296-bc428478e9c0", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877546, "uuid": "01866365-672e-4892-859c-9500e05303e0", "value": "3072:DWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:D42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618877546, "uuid": "f0edd67d-849d-45f8-8371-d7fa6e7340c9", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618877546, "uuid": "6c1a6580-f603-4e15-b1f5-16be5882db42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877546, "uuid": "05c7c7fb-12ab-4e27-a8fc-07c4b6c66b48", "value": "04a0f313f4f8a273dfc009293d9e81d72699b080e11aa611e16c3a74e4cfaad4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31385639-a211-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948028, "uuid": "99eca25e-4479-4b39-85ce-51c504eded58", "comment": "Malware payload (Dridex)", "value": "67dbc11f9e727a4c97340b181e3867a7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948028, "uuid": "8aac7a3f-83e4-4e70-a679-79d2ab340a47", "comment": "Malware payload (Dridex)", "value": "04faf289668b213bdabef0ed97346616bf298816ef646d5e893717e069da7b7e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948028, "uuid": "fdc7b5f5-03df-44fe-ac3a-a96e148057c9", "comment": "Malware payload (Dridex)", "value": "498a89473eb30fd0f4cf0b1e8df341ca335dc0ad", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948028, "uuid": "3845d33b-59a1-4e39-827d-a4f079e87a5c", "comment": "Malware payload (Dridex)", "value": "20fab32f02443bf6161bd01d2ea483802635e2dc6675d7debdd8c0390f4c066eaade8bc03e7491a397aa10e1d6a5420e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948028, "uuid": "a7142733-487c-44cb-b690-66093b2b67e8", "value": "DBF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948028, "uuid": "a5ebbf2e-457f-4229-9fbc-70e699fcbb71", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948028, "uuid": "06c5b6c2-c0c2-4e07-bff2-791c198ea500", "value": "3072:RwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:RwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948028, "uuid": "96337399-54bb-4ec3-9b97-ca93820c858e", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948028, "uuid": "f4725be8-8bec-484f-bfb3-9f586e7efedd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948028, "uuid": "84eb6025-230c-4266-8df2-7ead595b69b2", "value": "04faf289668b213bdabef0ed97346616bf298816ef646d5e893717e069da7b7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d5faba-a1ac-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618904659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618904659, "uuid": "7ba16e93-973e-4785-916c-827929f75581", "comment": "Malware payload (Dridex)", "value": "ddde8beca54df289c4c56ad9178e134d", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618904659, "uuid": "4219bfaf-1b12-4856-9ecf-13a51c0aadab", "comment": "Malware payload (Dridex)", "value": "050e1ce6c41170c9608ba3560d5f055792131f84773eb263714617d104c39b9e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618904659, "uuid": "25dad646-c31b-4b75-bd8b-26121ddbd6fd", "comment": "Malware payload (Dridex)", "value": "c4b5861cd2fb7979ef01da86aa50283d1c1edfd3", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618904659, "uuid": "a42683dc-ea8d-4f61-815c-ac5905961ab6", "comment": "Malware payload (Dridex)", "value": "88fa239b89cf6dcd85946a034b477aa411d7161011568716d4aeee93fccd9b1572e29fc3e5c7286b7eb7cf9167a13b54", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618904659, "uuid": "33a1a521-6b33-4f44-8411-14fbc2580e2a", "value": "B8F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618904659, "uuid": "11de0912-0da1-4d5a-969e-9deaae933df2", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618904659, "uuid": "0c0fc454-2f0c-47c4-9ef0-e0cfca8da0fb", "value": "3072:5iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:qeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618904659, "uuid": "20adaa91-c1fd-4992-9d09-519875a30e5a", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618904659, "uuid": "2ce8e3d9-a216-4481-ab19-0db67b8a9e6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618904659, "uuid": "26467e90-eb11-4d47-a908-a9b5827d5a72", "value": "050e1ce6c41170c9608ba3560d5f055792131f84773eb263714617d104c39b9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a983a889-a1de-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1618926326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618926326, "uuid": "ad6960a6-f57a-4168-9d15-2c777fb91888", "comment": "Malware payload (RedLineStealer)", "value": "a67eb692dacbca6d7e93b59bfbc02cd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618926326, "uuid": "89474057-c394-4491-8a6b-81555ac0fe8c", "comment": "Malware payload (RedLineStealer)", "value": "058781e2596ef9b23d167fe9aca26c443b6e8e80afc8bd9cbc018f52418bbad4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618926326, "uuid": "fea91336-87c1-48e3-8f38-5c3d14527102", "comment": "Malware payload (RedLineStealer)", "value": "309d9fef9092ef35730a25bb6b631cb293e35cea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618926326, "uuid": "f3c1e541-5643-4a92-a61c-d617bcd3671e", "comment": "Malware payload (RedLineStealer)", "value": "3f0e9bc55d99739473ab83f4b744468fa626462e2b7550eeb0cd6abaa0081adfc45e2c4a97d3dfb20cd8c3c50b289970", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618926326, "uuid": "8119b3f9-dcd8-4396-b61c-c64df9d43014", "value": "3F120A59F788E679EDBB1730ECB353004370DB504463DA5F6AD8891B29E3F5846926F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618926326, "uuid": "ea9dba99-a5a5-4350-97d2-1001b7939d61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618926326, "uuid": "a909f1e1-6561-4003-87b5-c3ae6d673d86", "value": "192:LBksuXEXVwV50eMZZ3R93VnjdwCzR3szM:RVwz0eM7FnhwCt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618926326, "uuid": "d75ded7d-a3dd-49a8-808b-963716ee88b6", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618926326, "uuid": "6c781efc-5dd4-4a07-a814-af160c754dae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618926326, "uuid": "fee20728-8181-4f6d-ab75-c070b9ff65a3", "value": "a67eb692dacbca6d7e93b59bfbc02cd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c2920cf-a1ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618917606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618917606, "uuid": "f8cc5af0-ffe5-46b6-adf1-f59f28c428f6", "comment": "Malware payload (Dridex)", "value": "a122c44374e8cfd5619ce4fa16ab0d28", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618917606, "uuid": "55009de4-62a6-4edd-b446-a034a15e77a5", "comment": "Malware payload (Dridex)", "value": "0588ab5e34ccf85598e83c2ebcac12f11f692c013c4c0d64057ee708e423e314", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618917606, "uuid": "64fb7b11-22c4-4f4a-981c-9be34cfeeae6", "comment": "Malware payload (Dridex)", "value": "759d9b6b78b3e84e49ee7f674de184aa2ca42a97", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618917606, "uuid": "79383352-b664-4c53-b7a6-b5bbb63fbe02", "comment": "Malware payload (Dridex)", "value": "4cd4558ff83ca93c0186600d8aeb62911c380fc262e2609226c30d707e2ba74004d270259d60ca006f2c8403819ac875", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618917606, "uuid": "bed6adc5-52c8-4dfa-a8af-2ea0e1a4e04e", "value": "FEF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618917606, "uuid": "38c81409-adf1-4f63-993c-58ba02deffad", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618917606, "uuid": "8bb976c3-de14-48fd-a516-0ae4e4f8aa4b", "value": "3072:Glpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Glo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618917606, "uuid": "7715f1ff-25ea-4459-8e32-2b11428d6010", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618917606, "uuid": "0323eb5f-a410-4266-929e-2106a340d114", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618917606, "uuid": "231335e3-106e-473c-be9c-7762f1785abf", "value": "0588ab5e34ccf85598e83c2ebcac12f11f692c013c4c0d64057ee708e423e314", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443c208c-a20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618946342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946342, "uuid": "04f8f668-4935-49e6-8d92-47b76a5c3558", "comment": "Malware payload (Dridex)", "value": "8b8ca8e6faa8356ca73a0590c22456dd", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946342, "uuid": "2882c332-04a7-4e4a-975c-ac59b5c4d70c", "comment": "Malware payload (Dridex)", "value": "05f9a33a476cf9b58f52a4674dad875f9accb301927abc220d3d094a963c9542", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946342, "uuid": "d1706ed9-56a7-4f93-baea-0497493d4683", "comment": "Malware payload (Dridex)", "value": "5c94379b3716a22278b6f27737a1405b2cbf5db7", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946342, "uuid": "0296821e-71ef-4339-8b82-6914805f7840", "comment": "Malware payload (Dridex)", "value": "3fee2e52a0c22d66a7cd14ecb55439c192543c71ec5dd29323d3818e3e4c578a856cbbfe08291753c19ea6258ca1c3db", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946342, "uuid": "18625fa5-9780-4c85-8289-aea6136a93a1", "value": "F2F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946342, "uuid": "1bde66df-aa44-44cd-ad3d-d0fa8a718124", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946342, "uuid": "769a9a58-35a3-4665-a861-92eaac00d03c", "value": "3072:JiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:6eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618946342, "uuid": "9846cf34-e7ce-4bb6-b4f2-219f6a5c596e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618946342, "uuid": "96d82ca2-949e-4e85-959d-17aa03232769", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946342, "uuid": "6fc0b304-4a1f-49c8-9a94-f8d5cd587cd4", "value": "05f9a33a476cf9b58f52a4674dad875f9accb301927abc220d3d094a963c9542", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb87f93-a204-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618942570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942570, "uuid": "8fe4396f-edb4-45ff-aa53-17a829c615f6", "comment": "Malware payload (Dridex)", "value": "79b898222bdea8384fb211563414062f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942570, "uuid": "094c7f94-ef44-4291-85c0-83a1c12a45b9", "comment": "Malware payload (Dridex)", "value": "05fa4d6b9965f0a32f8e6bb989369ff72f3be73d351f3abf7dde4cf635ada244", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942570, "uuid": "a7f38916-8a2a-49dd-a81a-9e6eaed5405f", "comment": "Malware payload (Dridex)", "value": "63ef7387361afb2d98b8a99e7148fd3f2bacb2d6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942570, "uuid": "0352fe75-0d64-43ba-9bf8-48dd07353b09", "comment": "Malware payload (Dridex)", "value": "8150bb31f7db489b674eeadc7e8597fe8061700f4cdaac9482300788555f41cb17b69abbbe8bffecd9f03b43f419f818", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942570, "uuid": "c9d39c7e-6919-40ab-9950-7d4b754a680e", "value": "19F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942570, "uuid": "0d64ead1-8a2a-49d5-9581-9b027350df56", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942570, "uuid": "5e179aaf-9b48-402f-938b-b386e3c85ae8", "value": "3072:3wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:3wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618942570, "uuid": "ae1e7c51-4560-4af8-8363-b24e07ba5e57", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618942570, "uuid": "f2285bbc-2ce2-4a84-8a33-22823a7aaf2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942570, "uuid": "e2075b1b-75db-4b4d-a90f-d2e37133d4bb", "value": "05fa4d6b9965f0a32f8e6bb989369ff72f3be73d351f3abf7dde4cf635ada244", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "225e63c4-a212-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948433, "uuid": "801b3d0d-c21d-40a8-9a43-23bd4967df59", "comment": "Malware payload (Dridex)", "value": "2c23fad1bc79da7e9fb8e2c9bcd86ccd", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948433, "uuid": "b75292c1-a28a-41bd-9fe7-fb757f34b1b9", "comment": "Malware payload (Dridex)", "value": "065b307c292a303d6314c1ac1d95ba48c4826b9696c9f9fc85a9c078e84c44d3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948433, "uuid": "a658a796-67a8-44ff-9dbc-bf0466736a8a", "comment": "Malware payload (Dridex)", "value": "b34046740d228755bcccd78a2ae060f70f298d99", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948433, "uuid": "882658f7-9f0f-4b7b-8e15-6a1dc968bf3a", "comment": "Malware payload (Dridex)", "value": "12223fdb1035abc431f853d99c9321f6efb04a7d6cb74cfd5db4cf4d4f73baf16afce14039a63326e78e4f7839c83289", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948433, "uuid": "c6b1e01e-6346-4cf4-8f2d-3def3f8ede10", "value": "6AF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948433, "uuid": "fc77e636-2ed3-4031-9cba-2022c350962f", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948433, "uuid": "8c4a1eca-80d2-4778-aeae-cf822afa2023", "value": "3072:dwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:dwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948433, "uuid": "cc2eb0c7-e3ca-4a46-8690-e4adacea9e08", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948433, "uuid": "13607cc8-9bc1-4001-91d7-5bb89e969627", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948433, "uuid": "ba9db99a-a005-4ce0-816f-35690899734b", "value": "065b307c292a303d6314c1ac1d95ba48c4826b9696c9f9fc85a9c078e84c44d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912ec671-a219-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618951625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951625, "uuid": "111b0c1a-fecd-4f34-bb20-31a02d9f2831", "comment": "Malware payload (Dridex)", "value": "da571fc2943c13f65db0abee2fa936b6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951625, "uuid": "81f9a1be-83de-4560-85e2-a4a869527e5e", "comment": "Malware payload (Dridex)", "value": "06824f8572d5f359475a939e16d538076e00a341468072e4ac8caf091387f65a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951625, "uuid": "a3fdce7a-ef4b-4447-9662-e74725a67f35", "comment": "Malware payload (Dridex)", "value": "5fa53a254c2077b51292f8c97f942ebd7817193b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951625, "uuid": "84ea7234-2da3-4f43-acd0-f20e6fa313a7", "comment": "Malware payload (Dridex)", "value": "d82729f745476819ecc586dc2a8df162dc5f6f676478815bbcddf905898430642cc783d49ef2335cb216a927a1ccc1b8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951625, "uuid": "92ebbdb0-e753-4aa8-839c-52db1f7d7bcb", "value": "48F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951625, "uuid": "b546d78b-81a6-49f3-8447-43b0f3d20b1f", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951625, "uuid": "31e49e9e-4f7c-4404-bce4-a7c0cf0d0090", "value": "3072:0wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:0wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618951625, "uuid": "af0c5a13-8074-4f66-aab0-90f3bcad7363", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618951625, "uuid": "ca11e6da-8f18-475d-94f9-b2de1e81a984", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951625, "uuid": "81f55366-62fc-4b1f-ad2f-c86f5d921ef8", "value": "06824f8572d5f359475a939e16d538076e00a341468072e4ac8caf091387f65a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7fdaaf6-a21a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618952174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952174, "uuid": "cdedeb4e-858a-4e87-946e-fd7f94dfc8e9", "comment": "Malware payload (Dridex)", "value": "66740f71403dc97e1e89b59b52d68d72", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952174, "uuid": "80cc4979-6b15-43c4-bf7d-3b22cc0b75fb", "comment": "Malware payload (Dridex)", "value": "068a1de5c3960988d16cbe826b4e50f37a6dbe36dcd4cb49208e4ef55c9fa6db", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952174, "uuid": "14eec1e1-bd0a-40b3-b902-3614340b10c4", "comment": "Malware payload (Dridex)", "value": "c516fbe36b8fe38e58e56e978423d19ac37974ea", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952174, "uuid": "17351e75-86b9-4a46-8d85-15aff7efc288", "comment": "Malware payload (Dridex)", "value": "2cad7f3c6912da180b1e2029d5f45c7a642e50b99dc626dddb30b20127253f82e41d4fcc04e8f3be3885acd6363e1e49", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952174, "uuid": "5c01807d-f1bd-49fb-8cd1-ddc160f7f909", "value": "57F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952174, "uuid": "32747c5e-c0cf-43f2-bb0d-9bbd2d612855", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952174, "uuid": "26107596-a0a6-4427-93ab-04a1234a87ba", "value": "3072:LwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:LwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618952174, "uuid": "c8f6a3de-9703-4fe1-b7ac-722c72d9ca65", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618952174, "uuid": "a8de4d30-214d-4476-aad7-33ad32eb7beb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952174, "uuid": "6c65b923-0947-4ce2-9e2b-8c21e9f11e09", "value": "068a1de5c3960988d16cbe826b4e50f37a6dbe36dcd4cb49208e4ef55c9fa6db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1642f9d7-a20c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618945836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945836, "uuid": "718318a0-698d-45f9-9109-b41f345f608d", "comment": "Malware payload (Dridex)", "value": "cbc466d0b764adc9f636277f128b7949", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945836, "uuid": "a68a7a94-b388-48fb-a406-4391843ebb97", "comment": "Malware payload (Dridex)", "value": "06c1579c76b1f067a91fffd2a6eddb95785b5caca7dc7e29eb92d16b77a43df1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945836, "uuid": "f4327956-3d48-49fc-b27a-fbc482655b12", "comment": "Malware payload (Dridex)", "value": "7218ef39a9531806d8d5f680e282070d012b6824", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945836, "uuid": "fd698d43-f47c-4900-bddc-3f3dd87487a0", "comment": "Malware payload (Dridex)", "value": "83584b2d320e5e4f60e31eefa0cd4a2dbe3f98836571643157840f94f895e119c74a55a906b65e27d92ef7e847d77b74", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945836, "uuid": "0d747fba-8df5-48ab-bb68-aadd94acbc91", "value": "71F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945836, "uuid": "e8b86a0f-dd93-4e13-8cdb-1aeca863ca0f", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945836, "uuid": "707d04b0-cd73-4206-9364-bfe7724e966c", "value": "3072:NwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:NwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618945836, "uuid": "6dbf80a6-d129-460f-8850-9d44e14cc82c", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618945836, "uuid": "4e5ea099-df0b-476f-a66d-a54d0e33ad43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945836, "uuid": "99f07cf0-e715-42a8-9cd0-09c0ceda2bb4", "value": "06c1579c76b1f067a91fffd2a6eddb95785b5caca7dc7e29eb92d16b77a43df1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726f1e9d-a217-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618950715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950715, "uuid": "f724b62f-7442-44b3-8e59-4fd1c4a124b1", "comment": "Malware payload (Dridex)", "value": "ee23530ba0078d2410af842f6f1551cc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950715, "uuid": "1de2be14-f113-4d30-b35f-ce6128370c12", "comment": "Malware payload (Dridex)", "value": "06e63e3fdac31b5f4abd6fe064027bfb16df33aead1fc4b15c120fb0c3264ade", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950715, "uuid": "7ac7c2fc-245f-4fc2-a7ca-bd2c8d0a056a", "comment": "Malware payload (Dridex)", "value": "0a1ac9931f2363efd9ccdbe1cb3172480463f4cc", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950715, "uuid": "5aa9d500-521a-48e5-bf76-ac87e3276365", "comment": "Malware payload (Dridex)", "value": "476007b5839a4db679d16f07fd2dfbc74e1dde9a2f7fc40d8dd42d7762b845c4f69729adc4779a35b5bda34d9289f53b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950715, "uuid": "39289590-c807-401a-8524-0304ca6923f4", "value": "FCF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950715, "uuid": "9c6f1a12-d954-477d-94f9-921667af2f7d", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950715, "uuid": "c10dc105-adc3-4612-8806-b0b8aab7da3e", "value": "3072:+wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:+wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618950715, "uuid": "9f289f45-e503-4adf-8bbc-84ffc227754e", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618950715, "uuid": "3cb65973-f1a2-46d1-b95c-7e0bda6ad909", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950715, "uuid": "5cfc064d-4a0c-4050-80ca-3fd9b8e01806", "value": "06e63e3fdac31b5f4abd6fe064027bfb16df33aead1fc4b15c120fb0c3264ade", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72315c2e-a201-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618941265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941265, "uuid": "4f61d6a2-f318-4b3a-aea4-24f9036394ab", "comment": "Malware payload (Dridex)", "value": "82160d358d7949cca5f89d95b976780d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941265, "uuid": "377b2bf2-514d-428b-ab66-4716e7934e86", "comment": "Malware payload (Dridex)", "value": "071c167d87c1d2b4baf76374a4a44f87a1edcb4d751a595dae5d32689f475bc0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941265, "uuid": "afba2700-571a-4d8b-bb2e-15670e1b4ef8", "comment": "Malware payload (Dridex)", "value": "732ff3b581b5a75d7bde4924e7e4fbe409f5723b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941265, "uuid": "3165e39d-8ddf-4f02-9d4f-808efaf5827c", "comment": "Malware payload (Dridex)", "value": "ec50852344235d4c6ba0780552272099d55dfb72493006c3b7afe7d5f576a76dd8c68234fb60345ca9baaebac0665753", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941265, "uuid": "f7d10062-401d-4f99-905b-cbb31a16a110", "value": "5CF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941265, "uuid": "9d905285-8e8b-4f6e-9f33-06b2a9d539c0", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941265, "uuid": "57192bb8-d204-44f0-9e2e-dfe8f0efc4e5", "value": "3072:ywZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:ywZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618941265, "uuid": "0ba62330-c215-4393-849b-0858b8a61a96", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618941265, "uuid": "563deff8-2cd6-4020-90f8-e0fc7efc08e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941265, "uuid": "f7a33249-6808-4c26-9047-aed7d163b1bf", "value": "071c167d87c1d2b4baf76374a4a44f87a1edcb4d751a595dae5d32689f475bc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b20cfc2-a204-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618942462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942462, "uuid": "ce635a36-e1f2-44cc-b420-357351feb539", "comment": "Malware payload (Dridex)", "value": "102a4d75368815566c489ebd84ec3f16", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942462, "uuid": "152415a5-e07b-4810-bbbe-988bac02b860", "comment": "Malware payload (Dridex)", "value": "076ea4354265bf994d3a42b7c386fb868e5e7e19d5d0900e4a714a0353476595", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942462, "uuid": "b1a8070d-dd68-4e86-bbc1-fc42144430c7", "comment": "Malware payload (Dridex)", "value": "2f1fa2f921fc5b18b93192daf02e395f764f965e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942462, "uuid": "1823ba25-e755-4423-a387-7c1ee1868d99", "comment": "Malware payload (Dridex)", "value": "b83118666f94bdcdee8f5822778e49585e6237ff3e5be79fd1aeb3e9701066e57c7edb36139d9c0f3ebd262ae50b635e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942462, "uuid": "4d875799-0291-4aa8-af45-badd26978d01", "value": "0CF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942462, "uuid": "16b1f9b7-6785-42a2-a3d1-30ce675b7fd4", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942462, "uuid": "6765435f-1b95-469d-b4f0-a7a3c2ec0663", "value": "3072:/wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:/wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618942462, "uuid": "c78b24ea-9231-4e62-ba3f-4275d9a949e6", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618942462, "uuid": "0a7c252e-0209-4a65-8598-e1d6f9bb5f9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942462, "uuid": "4911117e-0e5b-4894-8c43-db0808b3825e", "value": "076ea4354265bf994d3a42b7c386fb868e5e7e19d5d0900e4a714a0353476595", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc1b4d78-a1f5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618936289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618936289, "uuid": "e2902c49-b378-4465-a5b1-8abfae718216", "comment": "Malware payload (Dridex)", "value": "55ba5b04c0cdf359024dcbb4e554c838", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618936289, "uuid": "f852fab8-31af-4a55-a0a7-9180e5ffc9fe", "comment": "Malware payload (Dridex)", "value": "078b7f141cec3ebab9d65b16fd0b04cc7b2b0f487b169d9f69b1a8abe75aedea", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618936289, "uuid": "1c787b1d-1afc-4504-b53a-1ab141ed9df5", "comment": "Malware payload (Dridex)", "value": "d27115139899ee994eeee24ba12623094df2d26b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618936289, "uuid": "ff865188-4c0f-4ae7-b518-237cf62b9324", "comment": "Malware payload (Dridex)", "value": "1b8350aea53ad0eb95fe68a6e570ab7df0cab50acdbab0405237a2cf46614351ed4ffe2e9a0788afc2ec645f947a2aba", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618936289, "uuid": "eb8d5421-f445-453a-bccb-32903ef7504b", "value": "7CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618936289, "uuid": "28024f88-9999-41a8-aa08-9bb00e827a01", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618936289, "uuid": "acb75b10-a048-483d-a7e9-27bd1b8b2c5b", "value": "3072:Glpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Glo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618936289, "uuid": "410a6ad7-95bf-4b26-948f-2fefd667ad0a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618936289, "uuid": "651dde1e-35c6-493c-a809-5f9353600589", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618936289, "uuid": "3178551d-74d6-40ac-80b4-f4f2b5eeb043", "value": "078b7f141cec3ebab9d65b16fd0b04cc7b2b0f487b169d9f69b1a8abe75aedea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5586cc88-a215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618949807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949807, "uuid": "e761c07d-1339-4e0f-b6df-4796e915dcf1", "comment": "Malware payload (Dridex)", "value": "4364a8de17e10261c1f494da490cd943", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949807, "uuid": "e196e5d4-d930-4bf7-b51c-5aca1752d51e", "comment": "Malware payload (Dridex)", "value": "0797ef9769cffbf716e55f21066ff1d9765954be6ebcce52ebef5e8f8aff6e21", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949807, "uuid": "26e08b47-e784-4ac5-971f-cfaa61dbc412", "comment": "Malware payload (Dridex)", "value": "6d3962d47482137553cf6f7008569afd5ee8b6ae", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949807, "uuid": "fc6d6797-3c30-4e82-a778-101edc076705", "comment": "Malware payload (Dridex)", "value": "3564e0ed94ca6a69a39086814d7f213adc0a540291c7e5a7342d3dd7a6455c47677bdbdd73813a31d6b5e756116cff87", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949807, "uuid": "83b5cb8a-8ed6-4de7-a7a9-cd0260766290", "value": "2BF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949807, "uuid": "8e7c9b75-9e61-4d57-b11b-be00c46cfce5", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949807, "uuid": "82fc8d0f-b4a7-45f2-8da8-8beab5e13c36", "value": "3072:JwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:JwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618949807, "uuid": "2548ccc2-ab98-4735-84e3-c57a63ba2c88", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618949807, "uuid": "b5839818-d2ae-489f-a08b-f97d029da8ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949807, "uuid": "c25e440d-1b13-4ebf-8020-c18ebf0cf829", "value": "0797ef9769cffbf716e55f21066ff1d9765954be6ebcce52ebef5e8f8aff6e21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5633af9-a205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618943069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943069, "uuid": "588e3db2-d5f5-4de7-acf9-4dcde5e6e38d", "comment": "Malware payload (Dridex)", "value": "8b5a0e6cee02f3da18950514bb773c03", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943069, "uuid": "ec73ca0f-1e6d-490c-8d84-3fbd2dae20b7", "comment": "Malware payload (Dridex)", "value": "07a911b3f102e6c0ec31638f5568d9721c26822b60cedb0634e3ab2204b734dc", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943069, "uuid": "beb3b752-dbef-47c0-b4a3-46e518af5765", "comment": "Malware payload (Dridex)", "value": "91001a03f781643d9bd9b7e1493cc47f627f8276", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943069, "uuid": "5118660d-24b4-4be2-a5ce-92ec832d138b", "comment": "Malware payload (Dridex)", "value": "96a35c1964bb6369850dc9c984b930fb36d4d7ce583a7239d96339641f6d3f60c7de45adfb22bcd5cbd43146b27135f4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943069, "uuid": "14194e70-0b9a-4a82-a33d-2da1559ca4a0", "value": "9CF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943069, "uuid": "33f33a06-c0d7-4c6d-9cc4-17f1c76560f0", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943069, "uuid": "c98a9534-e135-4129-a194-efde8010fbdd", "value": "3072:1wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:1wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618943069, "uuid": "6cf58a62-682e-40a7-a906-bde8fec05dbc", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618943069, "uuid": "ba42b76b-b1b1-47c4-a096-5df5ffb6933f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943069, "uuid": "b0349f64-31cc-4f04-b1ca-5cd49bc21c87", "value": "07a911b3f102e6c0ec31638f5568d9721c26822b60cedb0634e3ab2204b734dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc3fc85-a203-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618942248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942248, "uuid": "b506b54c-02be-45a1-af16-0b036b967185", "comment": "Malware payload (Dridex)", "value": "9d03d2aae1f033d044661f6ff8c7def2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942248, "uuid": "0afb64e7-cd53-4387-ad68-79cc248a82a1", "comment": "Malware payload (Dridex)", "value": "0840b8ae47da86d2f07c406e48b606181e933fe26e39f9f1588fd548afbb9dd2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942248, "uuid": "47562ce2-c47a-4d48-8cfe-647ebb388cc8", "comment": "Malware payload (Dridex)", "value": "05b00658780951eb75e120a8a1c4f408b74a861f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942248, "uuid": "57b76c4d-e960-4b5a-a146-70cccd8cc38f", "comment": "Malware payload (Dridex)", "value": "d276327170a97500b347045a49ee2f151531df7db94f1859cfac781e2ed3ca6018de7261ba2c7f446732988319a70460", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942248, "uuid": "68a3cf82-7fbd-4b66-9967-3708006cb48e", "value": "A6F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942248, "uuid": "90ed8557-4237-4869-a20a-1c380eadd26e", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942248, "uuid": "1adaad1f-3097-4327-a0f0-e474026a6342", "value": "3072:4wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:4wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618942248, "uuid": "3250fc67-9558-4724-8bad-64e1bd5ca5d3", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618942248, "uuid": "cbc87523-04a4-4246-8524-0f3e625d3c60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942248, "uuid": "a70e3a5d-b88f-4b49-914c-b0c4d9f066ac", "value": "0840b8ae47da86d2f07c406e48b606181e933fe26e39f9f1588fd548afbb9dd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f745b9e-a224-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618956132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956132, "uuid": "608a30a1-c62d-4819-b07a-56e6903dc9f0", "comment": "Malware payload (Dridex)", "value": "584664873fb9982a4bd3e6fed7c51905", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956132, "uuid": "b9c2563d-ee63-4db4-8744-a6ff514909ad", "comment": "Malware payload (Dridex)", "value": "084e50d19176193c0f7d02cbcb8b78fd968f0f5ab56e1a93cac312c3d0507198", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956132, "uuid": "237390b1-435c-4846-adec-4b8f6968a157", "comment": "Malware payload (Dridex)", "value": "f9220e7a64ed89fdfffd044327cde3c1364c34b5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956132, "uuid": "8bcd7496-9ec6-4df9-b93b-55046ab7708a", "comment": "Malware payload (Dridex)", "value": "162793e7f1149fc7c64bcfcb0dda5e55907e73a89050b930b3a7d989291e203f592e6b4ba887af5b08b11fcdd6fc0f76", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956132, "uuid": "292e3bc1-6428-4400-8e89-b2db1a00a0e3", "value": "C1F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956132, "uuid": "7fff8420-dae0-4916-9965-88a51949f0d6", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956132, "uuid": "192beda5-4588-4ac0-8f5b-df79cdf931c0", "value": "3072:AwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:AwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618956132, "uuid": "b9895b72-a73a-4f07-99bd-91686327d0c8", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618956132, "uuid": "8ff5dc69-d6a1-4b4c-8b87-de097e2cc851", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956132, "uuid": "fca07bf8-0b03-4983-b749-161969aeb539", "value": "084e50d19176193c0f7d02cbcb8b78fd968f0f5ab56e1a93cac312c3d0507198", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044183e2-a1d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618920465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920465, "uuid": "fd7623eb-9ade-4610-ac4b-a77014556cc9", "comment": "Malware payload (AgentTesla)", "value": "3c490990ec33d87c1f75bc054bfb784f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920465, "uuid": "0b8205fa-1532-47b7-a7ee-bdb860c04b2e", "comment": "Malware payload (AgentTesla)", "value": "08579535e5cfc65a45863a5446ec806abe70b4f34071478f1b388b8e2d26df00", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920465, "uuid": "a1624a99-4c06-4353-a752-4ad2ea5ce5d5", "comment": "Malware payload (AgentTesla)", "value": "bd212a18a1248a15aeba0f52a19ef22f2a8469fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920465, "uuid": "066ad9d3-ff9d-463b-abf1-77c5451d9ac2", "comment": "Malware payload (AgentTesla)", "value": "b3c42b997f0630b43b2db9a6d2eb7238c2385a7e711b787399ca4a990828d0a33500e933b7ee7f1d1caad3a99c4164a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920465, "uuid": "e1ce009a-040a-48ae-9a03-ab0bffe986cf", "value": "1DD4023133EC9758D8BE8B751460464063F7B52AEB22DB0D7D6C016D9DAB6438722BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920465, "uuid": "7e4cdec9-b545-40d0-a9fa-b8ab68eac2d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920465, "uuid": "5f3a1602-eced-4109-bd25-79c2bbe8633e", "value": "12288:hzzRRRRRzKCX2xR03xX/bFzb708n/4ZkqBM3MzOlklHlzMaC:NRRRRReNRGX/bVvONzqQdMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618920465, "uuid": "055e368d-d347-4e8d-909e-f9c0fef27725", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618920465, "uuid": "fa498742-fb56-4a6f-a919-6672b323d69d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920465, "uuid": "5c5c69d2-0641-49e7-9fbe-320ce9cd4a55", "value": "3c490990ec33d87c1f75bc054bfb784f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aee1dfc-a20f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618947239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947239, "uuid": "cdd22201-1979-4e4f-8e64-a02673c3b45f", "comment": "Malware payload (Dridex)", "value": "4d29c0b2438bf2d9fec2837ad09b0896", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947239, "uuid": "263a2600-93b7-4d19-9b39-7798a3e77d13", "comment": "Malware payload (Dridex)", "value": "0887c779ebc1268a30bd41822c960fe7bc311e216cbf2e02ad56d7a3bed036f1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947239, "uuid": "860c8ed0-c1ac-4303-a7b5-6bdf59eb1c11", "comment": "Malware payload (Dridex)", "value": "f0b07648b45ec83f1fac51695b5b3d0cad9fd5e1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947239, "uuid": "acb28949-454e-4a3d-aca3-487330ae4338", "comment": "Malware payload (Dridex)", "value": "eadfcbfd0d725ba8b2303e7d4aaef1b9128f966369c272f4b58795f14bbc95fb66e25bb15a9afb40c4781d79de3ddce3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947239, "uuid": "54e3f5a0-6e9d-443f-b792-c3ea0ac199dc", "value": "5EF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947239, "uuid": "1b5f3d0e-ca81-4431-94e4-209f1c88d055", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947239, "uuid": "067e2162-b85a-4e6a-97cc-9681be4806bf", "value": "3072:awZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:awZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618947239, "uuid": "512b50e0-ac29-4bc8-867e-a5f71e87b16b", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618947239, "uuid": "9bcfe584-fbf2-4a0e-b7e6-75eab29e76bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947239, "uuid": "4fdec06e-3932-46ca-84d9-dc5165ccd542", "value": "0887c779ebc1268a30bd41822c960fe7bc311e216cbf2e02ad56d7a3bed036f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b485253-a223-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618955749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955749, "uuid": "78865e1c-cea0-40b3-9585-74216b0ae4ce", "comment": "Malware payload (Dridex)", "value": "a02eb802a27df57d3391ae2a1c9f4de0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955749, "uuid": "ab4e06f5-def8-408f-a6d3-ec0309587361", "comment": "Malware payload (Dridex)", "value": "088918106fef1a61d6413fa6af761d64fe0af518a5ee2504d1a155279b33440b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955749, "uuid": "f2ac36f5-6d27-4110-a95c-4466ebfa46cf", "comment": "Malware payload (Dridex)", "value": "af4072df09f7cad1394b15026eff0c7037bb7caa", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955749, "uuid": "6094d984-bf6e-4c75-afe4-73bb8a0d1e65", "comment": "Malware payload (Dridex)", "value": "e92f012dafc174dc6c10764fde995e69456004f6c6c39801be923b66b13d217f76c657526d3a158c1ea7aee3f47ff5d6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955749, "uuid": "2169f8d1-1cec-4fd0-a62d-7cccd0735396", "value": "87F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955749, "uuid": "21040fb2-4730-4107-89bb-2041beca2142", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955749, "uuid": "0c4c4ef9-eee5-49e5-9fe1-a11628cc3928", "value": "3072:gwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:gwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618955749, "uuid": "5d6723fe-f23c-4f4c-93a0-d3d3669d4edc", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618955749, "uuid": "15c55048-7e29-42b5-a600-f352423a8f36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955749, "uuid": "632be7f0-7320-4973-ad2e-86f77d4fb0eb", "value": "088918106fef1a61d6413fa6af761d64fe0af518a5ee2504d1a155279b33440b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c17b50a-a20b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618945496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945496, "uuid": "6cbb88c4-cb5e-474d-ab5a-bcc455c95210", "comment": "Malware payload (Dridex)", "value": "fac1b1dd757bae635f02055ea4a4a8c8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945496, "uuid": "fe07fe92-7a97-427b-b0cb-a3f1e8786e7d", "comment": "Malware payload (Dridex)", "value": "0896957da1cd8ac802166b7d6f4034e8e5b8adc1072c10ca43c4accb40d7ba65", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945496, "uuid": "de1140c8-fa5b-493e-8f2c-36e266df9f62", "comment": "Malware payload (Dridex)", "value": "9cf2d219f09bb8d013b7aeb80e3b6291b2af8a0e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945496, "uuid": "a0dacd44-df50-40b7-bc92-5846bcbf878f", "comment": "Malware payload (Dridex)", "value": "1139afe3e3262a8ae7ea786000b4b14bd98a43c72d98dd56437655b373834a99a66771b26d098adbd2e9f3edfe0a2ffe", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945496, "uuid": "0f83a158-2e72-4167-b2f8-b8e30fe2a66e", "value": "A0F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945496, "uuid": "ecb59594-e723-46c2-80cc-05c45bcf2b43", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945496, "uuid": "1d5f5853-04dd-4cd4-9d70-7e32c7f4c927", "value": "3072:fwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:fwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618945496, "uuid": "0eb2df52-ae45-47ce-9472-0c4975bc82f6", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618945496, "uuid": "daeb0913-9164-4d9e-b2ca-97eddbafc24e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945496, "uuid": "0a8911a0-5f29-41df-ab3e-c4ebdb8da4f1", "value": "0896957da1cd8ac802166b7d6f4034e8e5b8adc1072c10ca43c4accb40d7ba65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ecad887-a215-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618949930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949930, "uuid": "47166fba-716a-4bc6-b5cc-e5e76f7f8547", "comment": "Malware payload (AgentTesla)", "value": "d1a4c4d05ecd22dc4911c2d2a95a4e05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949930, "uuid": "187aecbb-e4c6-42e2-b0f2-78e27cc3caf0", "comment": "Malware payload (AgentTesla)", "value": "08caa9af8bc3d72fc768962c2319b86c9712a2437e6ca0e7cca8fc1049536def", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949930, "uuid": "505363b7-e8d4-4712-85a1-d3d6b9cde047", "comment": "Malware payload (AgentTesla)", "value": "7566d86a447176a6a73ec6603df6a987da8681b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949930, "uuid": "742a80e2-db6c-4481-a33c-ccf52f23017d", "comment": "Malware payload (AgentTesla)", "value": "cd1c658b6b9afe9af3bbdd0bb3032e9d7490635efea42a37662165a428a05062cbc714f6b8b85cbbb6a442c11d3b8d5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949930, "uuid": "d1398f56-1a92-4d70-9fa2-befcfc1fe537", "value": "5D050135569CFB89C02E2776E860053107B3A263F366CB5FE88C51985E25782F87C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949930, "uuid": "bdfad300-1056-47df-b0f1-135110ed4046", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949930, "uuid": "7961fa15-5931-4bbf-a9c3-81ca5c41ef7c", "value": "24576:4xKR3rBLOLplL7aNssXhdKtgSjLjERYgB/B:KSrIFlHKsq6tdzERYgB/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618949930, "uuid": "895e7855-1f0e-40f3-8a02-2418a429dbd9", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618949930, "uuid": "ed7a0602-eb55-485c-bb98-5aad0ec7eb14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949930, "uuid": "141fa774-d8c2-4537-b71b-95b99e18534c", "value": "Outstanding Statement-0413.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaefa761-a207-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618943938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943938, "uuid": "ba397785-07ef-46ba-a9cb-2a12f69a7056", "comment": "Malware payload (Dridex)", "value": "e6e3f67731bddd70132898a4085c6539", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943938, "uuid": "81b1547e-e28a-4061-9fa1-791efcf17089", "comment": "Malware payload (Dridex)", "value": "08cc3aba917b9778a5b7d41d91db3149861e7919cc0d6a344ae89ed8e3c6b322", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943938, "uuid": "24d4c002-a12d-44ce-9ad9-965886eebfb4", "comment": "Malware payload (Dridex)", "value": "a947521275224c9c11808ed7b7880c98887f7ba7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943938, "uuid": "f1eb229c-8a83-4302-934c-ec69ca3de51b", "comment": "Malware payload (Dridex)", "value": "bb1462263e925f991691077e46902fc2662c13c5cbfd9b26ea77b7d30566b3667c194b489d40887bf17c09b85004b9f7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943938, "uuid": "286bcb6c-8856-49e6-9217-39009e816763", "value": "4BF3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943938, "uuid": "980ca1b2-dbdb-4bd3-8c6a-2c7296df5296", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943938, "uuid": "f15eb22c-b7f4-426e-8e14-5e50416b3e5f", "value": "3072:nwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:nwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618943938, "uuid": "3bfbbc6c-87e4-4f5c-98b7-41dbcbb0ce1d", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618943938, "uuid": "8a716e8b-7a43-44b6-bc8b-e48bc2ef44a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943938, "uuid": "09b2c299-5a09-439b-9f4a-6a54b727e523", "value": "08cc3aba917b9778a5b7d41d91db3149861e7919cc0d6a344ae89ed8e3c6b322", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bdb6912-a1f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618934249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618934249, "uuid": "f47ef176-a822-4960-addc-336429a6b6b4", "comment": "Malware payload (AgentTesla)", "value": "074f128ce5b65e4a4476f2a94e8385a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618934249, "uuid": "d98ad234-1fa4-4043-b41a-0300e5982d6b", "comment": "Malware payload (AgentTesla)", "value": "08e77514797ab41006472f0de27fb3951cdd0f7fc268cd1c010a3dbcb5f876dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618934249, "uuid": "f28be804-d111-4944-a8ea-0d4a1b66ea2e", "comment": "Malware payload (AgentTesla)", "value": "0b028f26211fedaaaf99de0afd2459f88eb9a74e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618934249, "uuid": "24de2e83-91c1-4569-ae45-199ea111286e", "comment": "Malware payload (AgentTesla)", "value": "28066915be3025e6708f7b20061d19e30e4dbddfb6fb22413296f5e4fbc992adce3109a445435b0f851b1a4021fc7296", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618934249, "uuid": "3fddbc12-e060-49e2-8164-6096a5d715e8", "value": "4BE4E0713259DA98D87B0BB10835414003F77E1EAA56DA0D3CA9366F7BB73438722B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618934249, "uuid": "c8958337-f357-4d6b-b079-bd9c8061fd4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618934249, "uuid": "c5617f1a-47e0-42d8-a4e3-3b7e6999907b", "value": "12288:xU8v5jOKsLxYYLK9v/zoMT0fak+JaedXWA4nFzRRRRRIEAmDa:zlO1OYe9vby6aEeRRRRRIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618934249, "uuid": "cd02a2d8-7971-4a4c-9a6d-a8d58d1f7f4e", "value": 666112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618934249, "uuid": "7285adfd-507f-4593-8fab-21d6fc49e2c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618934249, "uuid": "8a6fc5c8-4569-4dab-9ab5-bbb409eb544c", "value": "SecuriteInfo.com.Trojan.PackedNET.672.22721.5643", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18c3a42-a1d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618920810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920810, "uuid": "efada93e-74ce-4d76-b102-5c9852d57f7e", "comment": "Malware payload (Dridex)", "value": "c53984bef4806e497352eca8d9747728", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920810, "uuid": "acb99983-dcc5-4e98-baff-7ec780903ff9", "comment": "Malware payload (Dridex)", "value": "08f1bbe7a7a9e64b75d0e8fc7f98f6637391e93109f7ab5652c6259a16b83181", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920810, "uuid": "262496ce-2045-4a5f-8677-878ac296c176", "comment": "Malware payload (Dridex)", "value": "9de39849d271569458d5c3f7a234c93e6cec3e81", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920810, "uuid": "ff828871-5136-4d01-b94f-c2afa9f569a7", "comment": "Malware payload (Dridex)", "value": "fd6c72f5d63b612d3fe8d5dd5aec5d8677ca5c39debe7e148d62362923583f9754279bc528383aeff4967f3a7227dd94", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920810, "uuid": "00b4e885-d533-43b1-b875-28041da65791", "value": "6EF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920810, "uuid": "47cfb59b-da6d-4f21-a002-b1b1ca96777f", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920810, "uuid": "0c61fc79-c771-4c04-937c-6702a9ce2c01", "value": "3072:tlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:tlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618920810, "uuid": "097e83bd-cc45-417e-b472-306868bef51e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618920810, "uuid": "626a4d6d-ae28-4e64-8c83-995417a522a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920810, "uuid": "1c803f43-cb49-455f-a228-ace06abc434c", "value": "08f1bbe7a7a9e64b75d0e8fc7f98f6637391e93109f7ab5652c6259a16b83181", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d015de5-a218-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618951108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951108, "uuid": "64102b15-4e06-4cf5-aeb2-809440e34d16", "comment": "Malware payload (Dridex)", "value": "ebd73a885fc626d19c65b9c843848f3c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951108, "uuid": "0888778d-5b95-4be8-b3aa-24c99a76c17c", "comment": "Malware payload (Dridex)", "value": "0933d4de6346e5938396b089fdd5f3462683308c65b948b374e5a5fc74121a3f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951108, "uuid": "1b68d26c-21f6-4a4c-bc3c-8511c9154df3", "comment": "Malware payload (Dridex)", "value": "676c6079a6fdc9898d9d7fb88bb303a370bbe343", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951108, "uuid": "3ed4a618-854c-4468-b70d-0983c85798aa", "comment": "Malware payload (Dridex)", "value": "92cbf7b084bfe89a3a32533b5e3fcc75b2eda4bab51e0f25ffe9579f4dd0eae6a04a5c8c145bb4a531faafa8965a29e4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951108, "uuid": "841dfbca-cdbb-49e4-9808-54546ab3ca75", "value": "DAF3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951108, "uuid": "04652cc3-12a3-4b34-b44b-a7ac169a7fd4", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951108, "uuid": "d982d6c8-e284-4a99-abab-29916ab31efd", "value": "3072:MwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:MwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618951108, "uuid": "28bc1804-6006-4325-8a0f-4fa4403cf98f", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618951108, "uuid": "5b9cb646-b494-4621-b108-c533dc94abff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951108, "uuid": "2ba14e00-515a-4bed-901c-0d6a93ee813d", "value": "0933d4de6346e5938396b089fdd5f3462683308c65b948b374e5a5fc74121a3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a3431f-a1c6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618916068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916068, "uuid": "10e36bf3-e378-413f-b78d-b71e55741c4d", "comment": "Malware payload (Dridex)", "value": "d66cfca624a206fb8a62401c608a93af", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916068, "uuid": "861cf2e2-b72d-43f0-8164-4c526d9e22e8", "comment": "Malware payload (Dridex)", "value": "093cb84a338b4cb29b29cca7984514482708ce1bd3c82a2041611d3a2360723a", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916068, "uuid": "18519cff-f089-4134-9528-c6f5e86719b3", "comment": "Malware payload (Dridex)", "value": "b06c664b4f8ee3450fea049d74f4a5784f93b6d2", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916068, "uuid": "c246c667-49f1-41b6-9bb4-0c1f0b5c28cb", "comment": "Malware payload (Dridex)", "value": "8bd7f8d440b0cc3b6b868ba175f8066b6f52a6f34fa36e307adcec6d1b799092659dd4da6b50e57f4791e645c4a8c658", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916068, "uuid": "60ca9372-52ca-4583-9f46-a6564adedf26", "value": "5BF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916068, "uuid": "1378abf0-f93a-4685-b862-211315b01208", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916068, "uuid": "62317242-b52c-4086-ab1f-18559ce126fd", "value": "3072:iWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:i42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618916068, "uuid": "2ed2797c-84b1-40ac-a100-1dc4da5045f5", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618916068, "uuid": "fd4e10ae-f2f4-41d8-af9d-e7d2d69ef66f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916068, "uuid": "d9e2707e-af2b-4ba3-a16c-e9b626e2e1a1", "value": "093cb84a338b4cb29b29cca7984514482708ce1bd3c82a2041611d3a2360723a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62cb701d-a221-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618954984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954984, "uuid": "f6969c5a-029c-4ab0-8795-ff714e307be8", "comment": "Malware payload (Dridex)", "value": "19dd4bdd8614efc2509435a619915ce5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954984, "uuid": "e3ba0178-42d0-4da2-b176-5fab21f92bb2", "comment": "Malware payload (Dridex)", "value": "09b3a24461266f4192afdc6a9e1487d55bfffa17ebd83fcf29b51b81e9c6472d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954984, "uuid": "1246a76c-0323-40ed-bc33-3dfd522dba24", "comment": "Malware payload (Dridex)", "value": "b6814dcd7f7d9c0469f0129bc12ad161b38f61d7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954984, "uuid": "56545893-b86f-407f-a7a6-fdfa4ecfd608", "comment": "Malware payload (Dridex)", "value": "452a82714d096728336eac486ebd22cbb8715d5764781d2fa17f4e6c6789fd60f7b221a408512fa4a347aaac4f956691", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954984, "uuid": "51906da5-768a-4c7d-aaaf-73c46298649e", "value": "F9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954984, "uuid": "dc2b9e32-9499-4457-98f6-d9618195ea29", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954984, "uuid": "c51f7448-461e-492e-aa76-7e5cc6535f63", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618954984, "uuid": "f6ebaa47-f50f-4dcf-b145-9e4439000c17", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618954984, "uuid": "8287549b-95fb-47de-be0b-fa4cb82809a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954984, "uuid": "a25f7499-1a6f-45cd-9c76-4568b4797961", "value": "09b3a24461266f4192afdc6a9e1487d55bfffa17ebd83fcf29b51b81e9c6472d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9866553a-a214-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618949490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949490, "uuid": "7dfbf8be-95de-450e-b361-71ed09d3c4e1", "comment": "Malware payload (Dridex)", "value": "75eaa066ca7492b97194abf0c349f80b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949490, "uuid": "b4cfb751-ba15-47ff-b45f-4f278bcc40ac", "comment": "Malware payload (Dridex)", "value": "09f5c792582317515ab2865e640e4f76d54216f1e5335fb530f8d61c98bbd38a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949490, "uuid": "d31aff7f-84e5-4d12-acb5-490cb2dd9c23", "comment": "Malware payload (Dridex)", "value": "ce6d632c2f8e415dd40d0e64b14277547814778c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949490, "uuid": "cde641cf-e059-4dfd-962b-f894e5241d8e", "comment": "Malware payload (Dridex)", "value": "47832175b77d6644f0f3457b8011be39c5c87ffc7944c74a0d1e31dc4424e66ab6c85275b02c7902934d597e51547fc3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949490, "uuid": "4084985d-2202-4932-9e51-37ebf0327c20", "value": "A3F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949490, "uuid": "d0b3449a-7442-4798-b0b5-84c5678e07db", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949490, "uuid": "1a36f932-5443-4470-9ba4-c7a9bc06972d", "value": "3072:0wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:0wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618949490, "uuid": "fbd66483-e2a0-4e67-afbc-76ec7aef5980", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618949490, "uuid": "6fcf9204-2918-4b66-a029-f3d19a33fa1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949490, "uuid": "02694543-665c-427b-acf2-9343da436700", "value": "09f5c792582317515ab2865e640e4f76d54216f1e5335fb530f8d61c98bbd38a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6f6763-a200-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618940851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940851, "uuid": "aef569eb-e2f0-47d9-9635-140c99f9ac25", "comment": "Malware payload (Dridex)", "value": "4fe1e8cd0f7d87cdae542d681d750dcb", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940851, "uuid": "73924126-ca80-4dc9-92c9-ee85a075c639", "comment": "Malware payload (Dridex)", "value": "0a0858da41425c5e96a891c8aa520e83d91788c8d6f9e49e88e0eb360f03babc", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940851, "uuid": "29767775-8cdf-4643-bb77-d337f571e891", "comment": "Malware payload (Dridex)", "value": "c78b845797a52a59a613f15e0681f54c831f2611", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940851, "uuid": "83a525ec-6862-48cf-8782-53b235d5c7c9", "comment": "Malware payload (Dridex)", "value": "6b74a20e5fa338de21ac98375806ebec19dfe09866cae64c4e21b87859d951dc9e435d72e7eeca8d231c7a97f6e60a7e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940851, "uuid": "81a724e1-93ef-40a0-9fcf-edca03597c00", "value": "62F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940851, "uuid": "2cbdf2b7-2136-4fbc-b97e-50d428d26109", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940851, "uuid": "eeb3c3e8-8725-4aba-b9e6-4b58e1a73056", "value": "3072:kwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:kwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618940851, "uuid": "01a1201a-e471-4c47-8a75-7124fb59e501", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618940851, "uuid": "8445f9c1-e75c-490d-94c8-5eb761d93e0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940851, "uuid": "d7394d32-372c-4908-b127-f0b682dc0a34", "value": "0a0858da41425c5e96a891c8aa520e83d91788c8d6f9e49e88e0eb360f03babc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20cf0e86-a194-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618894314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618894314, "uuid": "113aaf98-59cc-432b-9281-423cd326c0fc", "comment": "Malware payload (Dridex)", "value": "6081197d042a0d9ad1989177ec062d7e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618894314, "uuid": "cee33e9b-5d71-480d-b8ab-24c5f67e99d6", "comment": "Malware payload (Dridex)", "value": "0a771752871c3fc320fc3e791e16080f8b31ca3aaaed155f823ec9ebc3e7abb4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618894314, "uuid": "8537b8ca-65fb-4b68-9608-b238e21b7846", "comment": "Malware payload (Dridex)", "value": "e7d79739ddcd1ae86c62e5643c57e3656452f9b3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618894314, "uuid": "eae2f5f3-f33c-43fa-b66c-cfe1aa8c840a", "comment": "Malware payload (Dridex)", "value": "e2764cfd3cb34be5413fd483cbc21a878f531e4a289d1c26d481d927edde8e76dab7304b5b62e820560bbdda18571de6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618894314, "uuid": "2fada191-d788-4126-ba7a-d26232b28ed7", "value": "C5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618894314, "uuid": "bed9b8e1-0076-44f3-9f87-bd95fff8cf0b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618894314, "uuid": "0fc45f5a-aed2-4290-b688-c87a6cd0fccd", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618894314, "uuid": "736ec098-d711-4811-91b6-ca0e2b5340ee", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618894314, "uuid": "57f8fe1d-f4bd-4b2b-be9f-314b4a9d70bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618894314, "uuid": "6fe8be58-0a8e-46c1-a417-e433b862e6c0", "value": "0a771752871c3fc320fc3e791e16080f8b31ca3aaaed155f823ec9ebc3e7abb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e6dd09b-a1c8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618916724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916724, "uuid": "f0ed4eff-8e4f-4f9b-a769-aca653c8a630", "comment": "Malware payload", "value": "b71d7a389b0d16eec416a6397866b2e7", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916724, "uuid": "525a384c-98a5-4f0d-9853-45fdc7684c62", "comment": "Malware payload", "value": "0a970a46e85fb883e9a15e27e494b97f3acf74ee2be633ecbd40485ba3773476", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916724, "uuid": "2bf3a747-9d38-452f-9bab-3b69a64b2488", "comment": "Malware payload", "value": "8f2e9c1bdab64710ff7620b7ad63168c82b22ec2", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916724, "uuid": "e2b90b1f-34c6-4b53-8ec7-45b320d24c21", "comment": "Malware payload", "value": "df6bc68b178dbfce1e7d2334a97bf6c272b8e2665cac9ba42a52341129adcacd3a11c92b7525fb467fb1071668035d54", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916724, "uuid": "fe06b321-b696-413c-a160-abe9bf3aa12a", "value": "54C533C64DC29F43C39F38B551BB186D047E5E2259321C86AB9CB7207871BE2B7C4A69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916724, "uuid": "4a79098f-df3a-42c3-954a-c82c0b7182cf", "value": "49152:ll6iXGTRJw+YGScWDrgyPoeFHvZj7c8GDXBkag0RinyJBTzXjXvq0OmxEMYtpT61:/3Grw3GSdPgkocPhY8GXOagAcy3jjtOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618916724, "uuid": "33c15e50-8cbd-4eb0-8a19-d2161bf797b9", "value": 2625536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618916724, "uuid": "b594422e-3ee9-4a2a-a35a-1f105255e876", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916724, "uuid": "14987fd4-4eab-4a60-b1c5-4374f0c3a4bd", "value": "Arrival Notice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11eb6ff5-a214-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618949264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949264, "uuid": "28c1abb1-6a6a-46fe-90c8-dbc386d5d546", "comment": "Malware payload (Dridex)", "value": "30e97bf8d4d87fc6f5e02c443c40643f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949264, "uuid": "4f590675-a2a9-483d-9516-851615ae7222", "comment": "Malware payload (Dridex)", "value": "0ab8079fcc94b0712ea32f98210b569e1bf4927f77c7c4f32a4ee5f31401ab54", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949264, "uuid": "a61d723e-6644-43bb-9603-ea67a6868c7a", "comment": "Malware payload (Dridex)", "value": "a1229e7dfc5e330cdd033b3a44476cd7f13247f0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949264, "uuid": "2180b3cc-3052-4ee5-b7a4-189bae45de7a", "comment": "Malware payload (Dridex)", "value": "e8dfcde057c69595d4a4236dfc4a9080cd5e6d0bcb1003024be88c4544c8317d1f3d2f94b3f909c2980e603c7e0ca158", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949264, "uuid": "e50124e5-896f-47d0-bf4f-8753d26c809f", "value": "5FF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949264, "uuid": "44817da1-7ddd-4a39-b0f6-81d6bc54da8b", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949264, "uuid": "fa7c86be-be9e-4537-b103-4687ea951c3e", "value": "3072:SwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:SwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618949264, "uuid": "387bb792-28f2-4fa6-955e-4603ec5ed7b6", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618949264, "uuid": "2aeef7dc-7c7a-419a-8689-a2ac5c1d8588", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949264, "uuid": "c7e92e00-27b3-4110-8bd2-60649b7e42f0", "value": "0ab8079fcc94b0712ea32f98210b569e1bf4927f77c7c4f32a4ee5f31401ab54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a3c4b6-a215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618949695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949695, "uuid": "2a078171-b270-45be-8967-394f5853128a", "comment": "Malware payload (Dridex)", "value": "0bad9227c90d6625a03860b6c7e91216", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949695, "uuid": "5a1273cb-2fdb-4579-895f-56cefd44e3e5", "comment": "Malware payload (Dridex)", "value": "0abc2b7627bf22cae782ad3abf2b521e73a9a80efebdb72a7142840c41222302", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949695, "uuid": "9b233582-b0b3-4821-846c-e47649f1c765", "comment": "Malware payload (Dridex)", "value": "5ee412cf5b1d453a5e527bf6f76e423d639cf9e9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949695, "uuid": "394f9b6c-157d-4ac2-b23f-1df970d3d320", "comment": "Malware payload (Dridex)", "value": "2dc264824334b89dd291e76f12e0521d270aa42f9c70357eee4471a128a81b57222277085848fc2109826667569321e1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949695, "uuid": "f5063787-b10f-40e7-b90b-374d5bf59b19", "value": "05F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949695, "uuid": "22be4cec-18f7-42cd-ba9f-6252bb6a6d9a", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949695, "uuid": "ddb2b95a-f566-438e-9d0d-b2082b86ee77", "value": "3072:JwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:JwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618949695, "uuid": "e5404e25-511f-47a5-a3c1-61046f011ee1", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618949695, "uuid": "76569a82-2d1d-46db-bbe8-652c198997ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949695, "uuid": "1baf662d-1002-4011-8372-bbe3a798b567", "value": "0abc2b7627bf22cae782ad3abf2b521e73a9a80efebdb72a7142840c41222302", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9e4b07-a229-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618958359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958359, "uuid": "78727cf0-0b6d-4ec1-a2c2-800b96dbd2a0", "comment": "Malware payload (Dridex)", "value": "7233f6392ae9f6d1639991b109a2dbf4", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958359, "uuid": "553eb9d3-5850-41cc-b601-2a138914681a", "comment": "Malware payload (Dridex)", "value": "0ac21a9d181e4981c1285769e57401e5c06509764dd80cd4264ea47f668c6396", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958359, "uuid": "0134c6be-fbe7-48ef-8556-06734d2b2a2e", "comment": "Malware payload (Dridex)", "value": "6a44e4fe3ceb80ad6725d25a990ea3eaba7b8e3b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958359, "uuid": "15466c9d-a705-434e-b37a-fba97f92e435", "comment": "Malware payload (Dridex)", "value": "ca683f28fde6127e63ec49841a3ad36ca973b841421c39ad1df12e3823bc46fbe4667a10e4ff13464e2a4c6da809d23c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958359, "uuid": "0d117033-257d-4a73-96b0-b9f051b2573c", "value": "2DF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958359, "uuid": "dc70060b-1548-4da0-9291-a4150d19de83", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958359, "uuid": "e62f284b-99b7-45d9-b818-eced91c28c55", "value": "3072:RWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:R42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618958359, "uuid": "7e8e91dd-daf2-4c24-9fd1-ae8383ba392c", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618958359, "uuid": "c77dc222-0123-42a1-b164-32c58bdf1a4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958359, "uuid": "aacf840a-89ba-4d45-8981-7e27f3e78d58", "value": "0ac21a9d181e4981c1285769e57401e5c06509764dd80cd4264ea47f668c6396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d34d82-a222-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618955472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955472, "uuid": "8728fc3b-24ee-4f99-a4b1-4410b44c5375", "comment": "Malware payload (Dridex)", "value": "18a0417fdf0f21e42aabc6ff28c3eb7a", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955472, "uuid": "d4d602ba-f88d-49af-9ca5-6badb2c3ccb3", "comment": "Malware payload (Dridex)", "value": "0ac3523d4b9b92c545457698873e951429848eb2d6fb98f3e0064891272d6984", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955472, "uuid": "d2a49028-28aa-4b60-97cc-f143ea2f63d2", "comment": "Malware payload (Dridex)", "value": "cb3f8ff1f45ee60771ab7169db98a69dd4bb469f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955472, "uuid": "c146c90d-eb3d-41a4-9be5-e91defb20e7e", "comment": "Malware payload (Dridex)", "value": "da8b34e016562bd207caec45da3502bb17ddfeae58b8c8aead2b17c4a054db157bef4d20e4d15c132f97599c7868871a", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955472, "uuid": "26070ee6-b7d8-455f-ba23-286050a77dfc", "value": "DDF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955472, "uuid": "f7dd5cdb-289a-4b0d-b8a9-117ec7ea9342", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955472, "uuid": "8846cbe2-f7ba-414a-a6b5-ea0e614762d6", "value": "3072:ulpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ulo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618955472, "uuid": "f66c344e-4114-4be8-b066-4d6e4ffb7f21", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618955472, "uuid": "30a02bbf-fa04-4fd7-b6f6-02e3df8ec0e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955472, "uuid": "77ae7016-7df3-4b0f-8c10-1ede7ddc2d10", "value": "0ac3523d4b9b92c545457698873e951429848eb2d6fb98f3e0064891272d6984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46fa862f-a206-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618943340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943340, "uuid": "9bb16a98-09dd-4361-889e-f08d70c4e441", "comment": "Malware payload (Dridex)", "value": "0c93c34a52100ccf2b4aa02b80cea6f6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943340, "uuid": "677b7c85-178d-400e-a309-fed12d7422dd", "comment": "Malware payload (Dridex)", "value": "0b138937eed47b97c367b7d957fb02cb05922f0c4976e6e49ca6a1805f1aea58", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943340, "uuid": "50c482fe-784a-4733-88a9-73002069cb61", "comment": "Malware payload (Dridex)", "value": "f3519b0e9c479fbafefa3978e105e67bb188bedd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943340, "uuid": "45a9515b-c299-4cdc-9716-26dffd1664ac", "comment": "Malware payload (Dridex)", "value": "4a2f6bdb20ad66fbce2e41a24929ac99c2ebefdea8e083b95488d4484067a0e858a89f880b1113b32dddb32d5b82c827", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943340, "uuid": "be5e4535-80d5-44d5-8f1a-ad8a91e5f741", "value": "0CF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943340, "uuid": "28d5ec59-9cf4-4bf2-bf79-e5d224ca78f4", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943340, "uuid": "bbada6c9-a5a6-4d65-9fb7-cf4f0a6fe142", "value": "3072:bwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:bwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618943340, "uuid": "a9d5d1d2-b1d6-44e2-aada-c895d567d70d", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618943340, "uuid": "2d0b46e2-62ec-4778-930f-7ab4a9d8ce98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943340, "uuid": "a3267e48-a483-4981-ba6a-536777d42e8a", "value": "0b138937eed47b97c367b7d957fb02cb05922f0c4976e6e49ca6a1805f1aea58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734448af-a1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618910773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618910773, "uuid": "0462227a-cf67-4fcd-9df9-accb50c2e322", "comment": "Malware payload (Dridex)", "value": "bcdb8892ade3fbcef1e017b8c8acca6a", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618910773, "uuid": "909f2a17-d08f-4edd-9390-950039e158f3", "comment": "Malware payload (Dridex)", "value": "0b1d65243616e6e7dd9804775739f945cc67e80018a9584139efc45698a20185", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618910773, "uuid": "9e130082-4e13-4de1-8498-95f35dcb8a58", "comment": "Malware payload (Dridex)", "value": "e206f3101ea0ba57a23507148e8770b8e6815272", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618910773, "uuid": "25dfe137-1b0d-49f1-91e2-1285d488992b", "comment": "Malware payload (Dridex)", "value": "74e14598f8e7e9d6c4925a4a2092b1de256ba419415aeb5ea4cc4863542f93ab98453606dd8cefbb39383dc927338561", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618910773, "uuid": "3a350d27-c3eb-4a5e-b312-ea4f637e6581", "value": "DA354A1272D1C432E67217314C67D5EA49EABDA48F3045EBB3C82B2F2B776C10A3575A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618910773, "uuid": "0fb356f5-12fe-42f1-b3cd-1a8fcf8cb0a1", "value": "109992b9532b7167f00464da73141e6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618910773, "uuid": "c5044f3e-8ccb-4c31-a8c6-fc6247930895", "value": "24576:5r+fVBkzxJ7RY/uuTkA+94dP2Qm4VltHR6bPYEH/e0HdD:t+fVBUxJ7S/3Tn+94dP2Qm4VXxePYeHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618910773, "uuid": "6e564cfd-b683-45b1-97fd-6543f9e13a45", "value": 1105920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618910773, "uuid": "b5cb5e2f-c980-4ae3-8327-aab7b87b01cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618910773, "uuid": "c8826e35-3bcc-4320-808d-811a04da4afd", "value": "0b1d65243616e6e7dd9804775739f945cc67e80018a9584139efc45698a20185", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0757ab13-a21d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618953112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953112, "uuid": "69403656-fbd4-479d-ab5d-90df9779ed11", "comment": "Malware payload (Dridex)", "value": "16da83583bd747b929cbc0a2178b9a54", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953112, "uuid": "20b51203-69c4-4a39-9a0c-23c5a1e91137", "comment": "Malware payload (Dridex)", "value": "0b4ab3cfa285c4abc85da5602bb43d55486ee6f2ea2f8c30f28fadba42b724cd", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953112, "uuid": "06e44472-dc30-473e-81a7-60473747056e", "comment": "Malware payload (Dridex)", "value": "c8c93015a0a64a1c5bcf7dec58ae75c147a7f41a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953112, "uuid": "f587f0f7-f629-4d57-8ee4-c55afa6dc9d8", "comment": "Malware payload (Dridex)", "value": "8efdd32bb48008e493237bf25f26c932a60e378df62de1201796b847b97957c962f536b10d10f8f10d5dfdf72cf9fd36", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953112, "uuid": "d726f7bf-ee12-482c-a910-cd335d759452", "value": "6CF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953112, "uuid": "30b0b152-4d44-48e9-9fbe-70cf183c9fbe", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953112, "uuid": "3cbbb4d6-20ff-4ebf-8502-3fcdc20902d7", "value": "3072:IwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:IwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618953112, "uuid": "a9303235-fa11-4f8f-8197-e147d793cce2", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618953112, "uuid": "5e99e0d5-87ac-4a0d-aaef-8f75e88a3ee1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953112, "uuid": "75bafb72-9c58-4b3d-a042-3723813221c8", "value": "0b4ab3cfa285c4abc85da5602bb43d55486ee6f2ea2f8c30f28fadba42b724cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461438b0-a1da-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618924441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924441, "uuid": "81b2f5b5-45a7-4a13-bda6-530a5a8e8a24", "comment": "Malware payload (Dridex)", "value": "95c1e2f31879acce754f4225c79aa243", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924441, "uuid": "5e875835-1fd5-41f6-91d0-330bc9ef46d1", "comment": "Malware payload (Dridex)", "value": "0b4d93bb91ad1d793e118ca0c92e0c037b2e6ec9da3d9b0498b62a7336536c33", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924441, "uuid": "88b467d4-9f91-488c-be18-ee610c5c36cf", "comment": "Malware payload (Dridex)", "value": "63b03fe7308a5e54c0d30bd62e6f562381374a69", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924441, "uuid": "2159120d-1d68-4bce-b372-d5027d366b95", "comment": "Malware payload (Dridex)", "value": "ad4055a3873abc082f0aa6005b488f2dee129c9664b3cd9f112c509cea6901165f8a04a60e9e00b733644493c7d0b1af", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924441, "uuid": "b21a144f-a5fc-4a35-8ef3-c6d4e41d94a8", "value": "88F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924441, "uuid": "0688d2e0-4e3b-46bc-9073-df677ff26524", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924441, "uuid": "4e1d2848-55e5-4040-96dd-9d71ec4a9b38", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618924441, "uuid": "4081409c-a23d-4b1b-84fc-ddab47e24192", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618924441, "uuid": "cc892c83-0fae-4c16-865d-631f55c4deab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924441, "uuid": "20fb18ea-f018-4a40-b7fb-450b200ebc49", "value": "0b4d93bb91ad1d793e118ca0c92e0c037b2e6ec9da3d9b0498b62a7336536c33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4295046-a1e5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618929377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929377, "uuid": "72710e32-ceba-4705-a91b-a0614293e538", "comment": "Malware payload", "value": "30bd37045f34afc954bbd71642c25070", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929377, "uuid": "82c574b4-c2eb-4f90-8e83-4e5f7eef89ec", "comment": "Malware payload", "value": "0b6b0d31a56c8cb43db8af13c0d7247e70d0a852bae182eaaa4ce02e9191774c", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929377, "uuid": "5489aa84-f78c-425a-9064-8a7e9a91f0e0", "comment": "Malware payload", "value": "7956cbcc27fa2f90fa5593c29085f1acd359f1af", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929377, "uuid": "f447dda6-3ef4-4863-ae1b-e5fe6984c9fc", "comment": "Malware payload", "value": "9e3047c1c7500eb7b493c1a5521434d20c316f7af1389d7394cc8711211c4116d6e7f5ae847f3b606a4d90a9d19073d5", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929377, "uuid": "7dae8862-c05b-4fcb-a340-ae5b42705f02", "value": "B403F1BD932CB8B1C1E7A83E69477207D2EE215EDFE58805B240B9087B821D7961F1DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929377, "uuid": "20a28811-2f28-44b1-b803-e7c6a9bd83b1", "value": "768:O5lUBPi0N/lmQKUrnkv3fPXMFQzdLzXDxCl+ZetYjnqQHP84E7abz:O5O58QKp/XM0dX1CGetYLXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618929377, "uuid": "bc787ce2-4fa1-4e00-8be2-7685d91fa682", "value": 39577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618929377, "uuid": "4f436fe5-73c2-4e6a-b197-1f1d13e2b151", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929377, "uuid": "33db5c7b-bea5-4d70-b5df-86d338e69452", "value": "HR_IT_Training_Learning_Sample.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef24610-a1ad-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1618905021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618905021, "uuid": "5d956b40-afc9-488b-928f-a7f18aae9442", "comment": "Malware payload (AZORult)", "value": "90a302693e54f2291e288cd3146220f7", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618905021, "uuid": "7fbd59ce-25ec-47f5-aca1-be83bd11b88e", "comment": "Malware payload (AZORult)", "value": "0bbd6e19f9b1db43b341ac6abb2be9a323d289ea751b1bfb7aa928dfd2c6fc4d", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618905021, "uuid": "e432ca8a-42a4-4f33-8d5a-eadaec63a688", "comment": "Malware payload (AZORult)", "value": "f3d47fe230fd8a10ec2e33f8b19efd7e41ab7dd0", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618905021, "uuid": "2f961261-8522-44df-9c6d-037168d6acd6", "comment": "Malware payload (AZORult)", "value": "59bdb07c39f63f32fd2d290b9088fcaeec4adb5679b0a2500c27f4f68719b3c7227b1065049d2c697d146d7b28a28f25", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618905021, "uuid": "c025fd1f-547c-4b22-82e5-7f8fb4c9f60f", "value": "84059D5C7608B6DFC81BCE36D9641C34A661A1A7C30BE707A04F11AC9E4D69BFE191F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618905021, "uuid": "e91314b8-dacb-4031-928d-3425ce6c0651", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618905021, "uuid": "7967d36d-4925-44d7-a9a8-dbd673ef8ee7", "value": "12288:Q2LLqPOUzPqfHFRnyfA1nMwYRGbJL1jkgfZfBAZvbq+0Pl5YhLPlseaZSlRpKCiB:XLORWflRnqA1nMvyJjksgZO+0PYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618905021, "uuid": "94e4cadd-9e3b-4b0b-89ad-58ab07d2a8ca", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618905021, "uuid": "2ea385da-9995-4dca-b03e-b4330d88f9fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618905021, "uuid": "e38b33b2-4e6c-4d9e-8803-5561b565cb18", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865e1f58-a227-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618957620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957620, "uuid": "26caceb7-0a60-494a-b594-3ceede93bfb2", "comment": "Malware payload", "value": "c6d368e513f1dd723b2ae08c0a078a05", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957620, "uuid": "629065b2-6ba1-4e5a-924f-98eb168ff119", "comment": "Malware payload", "value": "0be5c112eb8f2721ea2b4d555ed8a85ab1cd6b4fa137b920845b5a7db6ba1025", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957620, "uuid": "45cc21c2-a77f-411c-8956-afbbb73c7436", "comment": "Malware payload", "value": "dc35a46feb24ce349e17ff8c1dc776b4484c5d2c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957620, "uuid": "ba2c6334-2361-420f-b07f-87fcc048b2c9", "comment": "Malware payload", "value": "0b7f1d508b0b06282f7b8781624c8d5d259fcc9bfbf16286ef3509e06e8dedea616f654ec915dae68ff6f7eeb089faad", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957620, "uuid": "ff7ed8ef-0ded-46ac-9ea6-ef866bb67c7a", "value": "66F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957620, "uuid": "90ff76bc-d1a8-47b7-8bca-5534485ec30f", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957620, "uuid": "78bd5b6b-74a9-4b3d-8a95-07b797c25391", "value": "3072:GwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:GwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618957620, "uuid": "4dfafe36-2960-412a-b51d-5837bcf894c2", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618957620, "uuid": "2c1148a4-42f9-414f-8053-27e537c3b107", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957620, "uuid": "32efc36d-7b84-4575-9d95-af5b2bbf3fe4", "value": "0be5c112eb8f2721ea2b4d555ed8a85ab1cd6b4fa137b920845b5a7db6ba1025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9088d2-a208-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618944187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944187, "uuid": "412f958d-59c1-4b76-8054-adaaffc47797", "comment": "Malware payload (Dridex)", "value": "da69adb96c3f166f778cc0bc308d679f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944187, "uuid": "a155492a-aa24-43b7-bebe-85f9f66990d2", "comment": "Malware payload (Dridex)", "value": "0bf3f911ba2d8c388823730a7d34ef92e2232fbc8f1c68e42401ff6a922c12fd", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944187, "uuid": "e4ab8c3c-5f6c-4a45-93f1-728d1accf1ff", "comment": "Malware payload (Dridex)", "value": "e6ea388d10178cf128813c2d4e7dc0e211c36960", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944187, "uuid": "8cb71586-b11c-437c-872d-022e780bfbf6", "comment": "Malware payload (Dridex)", "value": "c8b6c7e701db765d0f2af1178ee861354e93c201feccfc560f2f90ca936139aa10df1944d6cfdef01b3be90a44488b77", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944187, "uuid": "ba594da6-334d-4ad0-9176-0159cfb89636", "value": "3DF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944187, "uuid": "5d8478f1-5663-4b01-b0a8-ebba6b1101ad", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944187, "uuid": "3086bf2a-ca1a-42f5-98f4-4b4bc0aeb3b8", "value": "3072:swZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:swZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618944187, "uuid": "fdb11f03-636d-431d-b351-1d7c13af2087", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618944187, "uuid": "ed07ccc7-d76f-4e30-ab32-e00cb67d308a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944187, "uuid": "ada65c37-a0b2-43ed-b5c6-5ef651f90dcc", "value": "0bf3f911ba2d8c388823730a7d34ef92e2232fbc8f1c68e42401ff6a922c12fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3546b1-a1f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618937254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618937254, "uuid": "b4afbdae-cc85-4f2d-87d2-2e20917f208b", "comment": "Malware payload (Dridex)", "value": "79145df8af499edc62ec1a8208ddb25c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618937254, "uuid": "5112e9aa-ac6a-41d7-b9ab-82635b5be693", "comment": "Malware payload (Dridex)", "value": "0bf87ea03c3fdfe9b35d1cfd63965d9333e20bec4e796c833ceada059a004427", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618937254, "uuid": "97d0e00d-2b47-4c69-a292-6ca41bad8817", "comment": "Malware payload (Dridex)", "value": "d56a7717f8e3cac399e08362a72cbd9edec79048", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618937254, "uuid": "1f6a2a3e-7bca-449b-9429-f42b48315430", "comment": "Malware payload (Dridex)", "value": "edd78b1b7fa6da249a6eb2a80dad64db85122587f11c3e3e9800c1c4cfbce11ff520f350956cd8d2468777a094d2e3f0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618937254, "uuid": "03871737-258b-45f0-9874-3481ec01307f", "value": "76F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618937254, "uuid": "481729cb-6293-4894-90fd-4dcd77fd0b63", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618937254, "uuid": "49ef1103-bcee-47a4-9778-d88aa1a5e37d", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618937254, "uuid": "6778ad92-3c25-4996-b3f4-1a817a395819", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618937254, "uuid": "add9ce2d-4999-4c93-9e25-3ad119701c05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618937254, "uuid": "884d6015-ecae-4362-b2c3-ba65b810fc82", "value": "0bf87ea03c3fdfe9b35d1cfd63965d9333e20bec4e796c833ceada059a004427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46bab914-a226-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618957084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957084, "uuid": "542ac6a2-a683-4437-977a-554be732a34a", "comment": "Malware payload", "value": "051397666533c678784ca0be93ed882f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957084, "uuid": "5aaf6574-0433-4413-873d-3bcf4d844dda", "comment": "Malware payload", "value": "0c7400521c6c01bb90e35a744fedf39e2db1c91952e36838fd41382cef33b385", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957084, "uuid": "71774093-ed52-4587-b18e-6b33df3932dc", "comment": "Malware payload", "value": "e04ff19527262ce6a1aa8ddc45acb1389c5c6e6b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957084, "uuid": "89ef57ce-8c86-457f-84dd-b18b42ba7572", "comment": "Malware payload", "value": "163004962376f693811becf6058cb93b74832beb8064cb8bc8c27b5a74a4a3bdc079ad2ab76c7a78d0da2c762e3ef008", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957084, "uuid": "516009a2-aa9e-4ea2-bbc9-632d02354e44", "value": "54F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957084, "uuid": "5f5a4041-7a7e-464b-a58e-751994485198", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957084, "uuid": "c5f265be-7100-4afc-885f-ed5012f76a7d", "value": "3072:gwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:gwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618957084, "uuid": "5c8ba492-601d-4e66-9a07-442a01be6a41", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618957084, "uuid": "4b04e404-f998-4c31-a05d-36adc2cb08ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957084, "uuid": "458139b9-8d12-4356-b206-60db2a5fcb02", "value": "0c7400521c6c01bb90e35a744fedf39e2db1c91952e36838fd41382cef33b385", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0324bf8b-a1be-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618912303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618912303, "uuid": "2e6f786b-fc0d-4a03-a8d4-67f6d0df2cca", "comment": "Malware payload (Dridex)", "value": "04b4ceefa007964a21bb5930efcda513", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618912303, "uuid": "f63e045c-3823-4300-86c4-cf8af8993610", "comment": "Malware payload (Dridex)", "value": "0cf1812fa36fbf1b674edee92f3d4d6737d910741528e3606498237cd414a017", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618912303, "uuid": "29ca1e73-4c6b-4137-a03a-16e754613c86", "comment": "Malware payload (Dridex)", "value": "69458123caaccd2f0c4bbe99f7109e2f55984393", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618912303, "uuid": "2eb72a16-9ef3-4f9e-88e8-c7251e724201", "comment": "Malware payload (Dridex)", "value": "28728805bd0261034b859b77f8532ad7f1c008812973b57422fb2d7b2cf0948a7213ca110aad2cefba151db26e4c1071", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618912303, "uuid": "7638c530-a38e-43bd-b1db-615e7aed91d3", "value": "64F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618912303, "uuid": "8acb7c52-4e67-49fd-bff4-bd3b8582bd02", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618912303, "uuid": "11b73430-0875-45a2-b122-342419e17e34", "value": "3072:Klpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Klo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618912303, "uuid": "0356ae8c-921f-4c91-b985-ca6587b623df", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618912303, "uuid": "26210627-89d8-438a-9462-9e2cd141ab2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618912303, "uuid": "62a73c8a-97d5-4aef-a994-129981edb5ea", "value": "0cf1812fa36fbf1b674edee92f3d4d6737d910741528e3606498237cd414a017", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a5ea3a-a21a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618952059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952059, "uuid": "f115919f-74a5-42ee-8c9e-82257fbc5cb6", "comment": "Malware payload", "value": "86ed915fddc5197c72338d1ef45a888e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952059, "uuid": "475a46d3-856e-4736-a006-b7b11d7feee5", "comment": "Malware payload", "value": "0cf88d4da3e4b6b389472a09f725c3623114549c6be93943cb9fa50ae5f93ab0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952059, "uuid": "a3162bdc-80c0-47de-bffb-2cce66efa597", "comment": "Malware payload", "value": "c4008d564e2bd7f9b8c155c1c1d2acd2c7508f97", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952059, "uuid": "18633311-feea-4ae5-8b87-d1fbd8ab3fd3", "comment": "Malware payload", "value": "97738af9addc8ebd13ba7ef9d41f7c84f0941254f7a03f0a362ba6ee4e12f69a4b7a9dcd66f168cf06166b6b3af76b88", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952059, "uuid": "74b251a8-cf8a-4e23-a923-82d97ae4f326", "value": "3FF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952059, "uuid": "e4cb4e5b-b011-412a-bba4-913b79a4a9e2", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952059, "uuid": "e3ec088b-b0b2-405b-bc95-0a75bd98ae28", "value": "3072:4wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:4wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618952059, "uuid": "e3665da4-c2c5-4568-ba93-081e5ad3c865", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618952059, "uuid": "fdba0161-9fc1-4d1c-beaf-0fe316da4076", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952059, "uuid": "e534ed98-e71d-456a-a120-a79da644106b", "value": "0cf88d4da3e4b6b389472a09f725c3623114549c6be93943cb9fa50ae5f93ab0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb1b953-a222-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618955542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955542, "uuid": "bedebc83-9612-4e0d-a8a3-dc965b6c7ebd", "comment": "Malware payload (Dridex)", "value": "59ed65b4bc59e03a771d1eb02a0079db", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955542, "uuid": "4e85cc34-aa31-4285-bde3-534f70a27805", "comment": "Malware payload (Dridex)", "value": "0d1978356184bb2b0aba57fc4efe39eedf4840d6de33fac8f19c093db9a27ad0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955542, "uuid": "ace5286e-0553-4b4e-a45b-cdba31b2ee0c", "comment": "Malware payload (Dridex)", "value": "3b13da2bdaf2c6c2c30813b1fef57206d6753a99", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955542, "uuid": "91bf1bec-ddf1-4f02-a2c6-c582774b0f10", "comment": "Malware payload (Dridex)", "value": "cb1cef3a61e99e3793ec45b9761e53dbabf8a26e492c70fd717a5cafa2591d0ebcd53ee46f22814796ad0e6330c4af30", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955542, "uuid": "9ff9e8de-020c-417a-8669-9fcaa52aa719", "value": "7EF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955542, "uuid": "5bcc850e-a8e4-4e41-8d58-c456b1000588", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955542, "uuid": "5693ac3e-f022-4b2b-b5c4-2c11d0ec2fe2", "value": "3072:MwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:MwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618955542, "uuid": "cda99e6a-e17a-4448-a99d-bc1c9a06716e", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618955542, "uuid": "7f3cfae6-d91d-4a39-ad75-1e145cd0d73b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955542, "uuid": "d374bd80-9d39-4f0e-917b-451c21e3f386", "value": "0d1978356184bb2b0aba57fc4efe39eedf4840d6de33fac8f19c093db9a27ad0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8071cb-a20a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618945252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945252, "uuid": "d180ae79-6179-4260-9451-620fd8eb121d", "comment": "Malware payload", "value": "43fd28ecaeace181efbcf9c92beba372", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945252, "uuid": "82405d3b-448f-4115-bcbb-b0f811675a0f", "comment": "Malware payload", "value": "0d429448ceb1cd9b1412757154eaa58e5b08034b65dcd2e77439d617e9bd4944", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945252, "uuid": "592d2359-f233-4e0e-a4a2-0299255a33e9", "comment": "Malware payload", "value": "e02d5fa5f91ddc86a7b9d0430f2dece655642883", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945252, "uuid": "a81f73fb-b2c5-4d79-bf45-c2d97f099b59", "comment": "Malware payload", "value": "db8d69e5d3a9c3eff6ac06002654130f6f6ba874838777d66acf8651ad733f012c8786b2d4c61a77ada278babffb87d6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945252, "uuid": "4973c124-fa3f-4d02-9288-c760368e33da", "value": "19F4D4E8276C5A3F877B581BC2855F5A435C06131D2F69A4DF439F9CAE0EC8464EB8E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945252, "uuid": "565448a0-1871-4cf2-a02e-b97e44d2bab5", "value": "1536:HXCNGlxXMv6jtpp1WCrw5oVOeIeIHhuDiiarZiGlxH4c9oeZCefSXenKSk5J+udg:BXnpqHhR5IhV11rpJxCBHFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618945252, "uuid": "fee5d1d8-6a5b-48d1-932e-2887df875c94", "value": 734518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618945252, "uuid": "aea3ab29-f1ec-42c6-aeb5-549d0992967b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945252, "uuid": "f64ef1de-51eb-40b9-8f6d-a371d1d47ccb", "value": "Requerimiento.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c575c9a-a1c9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618917123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618917123, "uuid": "e8c53f56-5edb-4deb-8f79-3e0c69ee5f8b", "comment": "Malware payload (Dridex)", "value": "af0197434be544b1b6c5471cc06abb00", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618917123, "uuid": "adc95e8b-4704-44a8-85fd-e157b4a576ea", "comment": "Malware payload (Dridex)", "value": "0d45abb8559d1758c4b4168b59c866adcae438de2437b0996d2b684fe1e2e97a", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618917123, "uuid": "d7f31a44-cc75-42ee-b8c6-c8cb52bf530c", "comment": "Malware payload (Dridex)", "value": "9b9f94ab36232f3237289daf524641482d1f28ea", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618917123, "uuid": "f107d3f1-f41a-492d-a7be-43fda92378c2", "comment": "Malware payload (Dridex)", "value": "67433e5f1ab892b5160ab9c3776fc96e1dbc59697b15ff4d7e0a18f4365ba129ed05d627b8867bd32fbe58a2cae42534", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618917123, "uuid": "2fb9b2e0-d4ac-4635-b1d2-19e6b08c945b", "value": "09F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618917123, "uuid": "81f7c7df-fff4-40d5-8976-060c4eea057f", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618917123, "uuid": "ddc82b0c-e2f6-4947-abe2-de35e0e57379", "value": "3072:7lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:7lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618917123, "uuid": "8d0ccb11-1dc5-4ee2-913b-24237abae03b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618917123, "uuid": "74772b45-f112-4d47-b931-8426842217ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618917123, "uuid": "d560e0a6-d8e6-4170-bef6-5e62fdc64158", "value": "0d45abb8559d1758c4b4168b59c866adcae438de2437b0996d2b684fe1e2e97a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82cfcde-a22d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618960308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960308, "uuid": "f0271f40-1983-4c1b-82c3-3509f0562e5a", "comment": "Malware payload", "value": "9ca9b3a8b4120e061b8136167d003aaa", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960308, "uuid": "5ab2e6d9-bddf-4fba-a94c-b6253362043f", "comment": "Malware payload", "value": "0d54d778ced187177f81820a17d96f1c25fe7dca0e0f4fcc3685ef6233f73b97", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960308, "uuid": "c090080f-f431-4ef1-83e8-a40934008625", "comment": "Malware payload", "value": "719727178ee494fc8d33e1bfe804601b5a59f5d1", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960308, "uuid": "8368fe63-1193-4965-b74c-459c644251f8", "comment": "Malware payload", "value": "58bbd51d20b57b2179fe8b4e8ebbba4985a3cf3cc9ce9a00682354d276f41d7eb5a0f50fdf77a7e1d7d8a89edc2dae49", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960308, "uuid": "f11af396-8b61-4724-b0cd-70c113160cba", "value": "06F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960308, "uuid": "8b5065b2-40e3-4f93-a6fc-a78bb00832a5", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960308, "uuid": "13feeba1-000c-4928-bf82-da72feb16ac3", "value": "3072:lWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:l42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618960308, "uuid": "98b4b7f3-0c83-474e-a5d6-5991bfb6f9c7", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618960308, "uuid": "92043035-add9-454e-a301-f7a636956c8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960308, "uuid": "a568b6b4-ad15-41d7-b34a-bb72dc285052", "value": "0d54d778ced187177f81820a17d96f1c25fe7dca0e0f4fcc3685ef6233f73b97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1164b72f-a229-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618958283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958283, "uuid": "10257027-6997-4d9f-a6a3-ae6f866fd7d0", "comment": "Malware payload (Dridex)", "value": "8f3571716fd602ae5886c404b082371c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958283, "uuid": "67a70387-b59c-4752-990c-22bebee5a4f1", "comment": "Malware payload (Dridex)", "value": "0d81d300fcd9e68738c59a23683e95276076b6421f2b2fc1c9960b764610b288", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958283, "uuid": "d3f2d23b-50d5-45ed-be55-2672a22a39ec", "comment": "Malware payload (Dridex)", "value": "9c700ce185f576cb36842a0e695f9c512fe1d65f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958283, "uuid": "80cd634c-06ab-4043-b5b7-5138d772044e", "comment": "Malware payload (Dridex)", "value": "fbe46207fb23df29f65ec74964b36fc6a296d0275fd902b53e55710a82fad2d86bc473afdc5a6dde047a268fd2e83a2c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958283, "uuid": "3fd6d903-9b0f-4522-b6d0-58d9ad745e5b", "value": "99F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958283, "uuid": "bb5241ed-983d-4b9f-846f-bc37a66d9d7b", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958283, "uuid": "e3481e4d-d5d2-409e-8f8f-a2f3fc9f7532", "value": "3072:AwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:AwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618958283, "uuid": "d6191d2d-2ead-4708-b194-ff4b7238b8cf", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618958283, "uuid": "60741b4b-24ee-4fe2-909d-b3a82e15e360", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958283, "uuid": "ac6b9895-89e4-4e56-91a8-c60412e06535", "value": "0d81d300fcd9e68738c59a23683e95276076b6421f2b2fc1c9960b764610b288", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f938e4-a19e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618898589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898589, "uuid": "86c8c629-8fea-4c4b-9e33-212b1b584ad4", "comment": "Malware payload (Dridex)", "value": "b181b3256c3e905cba1da93bc71ae087", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898589, "uuid": "c6d9abb7-952f-4141-ac4d-147e02f130a2", "comment": "Malware payload (Dridex)", "value": "0dc71b6e4b430e0709ea9b19a62f1cf80a02678572bf28d7a0d5e1ad16c36ba8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898589, "uuid": "e18a2c75-ff1a-4e15-9b9f-d22db73bccff", "comment": "Malware payload (Dridex)", "value": "1db98ebaa73a55468745dfb6039c07d00a0f9f3d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898589, "uuid": "d8c9c047-9619-4362-93f0-0ec40522c37b", "comment": "Malware payload (Dridex)", "value": "af0d095235b815ca2f0bd675054b28a264aaa896282ddb75af5503c595bb6529e07670a0cb1e86d0fc28fcf9f19ad44e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898589, "uuid": "4c91e3cc-199f-458c-9680-afd9c05c09a2", "value": "6FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898589, "uuid": "d09aae73-2e3c-4e99-b99a-228a131c4392", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898589, "uuid": "a03a5461-0eac-4a6f-93f7-db004a6cd9a8", "value": "3072:gomNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gxLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618898589, "uuid": "083a46f6-0a5a-4a01-8ca7-887af7e6cb95", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618898589, "uuid": "750866ae-8198-44b9-b2b6-55e39ce4f02d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898589, "uuid": "c712e82b-0368-46e1-9e67-ae5060c46f17", "value": "0dc71b6e4b430e0709ea9b19a62f1cf80a02678572bf28d7a0d5e1ad16c36ba8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fbc0c89-a1f9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618937825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618937825, "uuid": "60f6a9ec-a9f1-48f0-bd6b-fa4ccb2c4ae6", "comment": "Malware payload (Dridex)", "value": "780603cd9b68788ba5be3b8d7688730d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618937825, "uuid": "0702c69c-4a5b-4701-a067-6fb6ebde9914", "comment": "Malware payload (Dridex)", "value": "0e4556421060857a710b760deb14c2c7abf09c221b794e291f0e59445d47eaaf", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618937825, "uuid": "569d27c1-dda0-433c-8941-7b23e11a8f48", "comment": "Malware payload (Dridex)", "value": "cd20be8aace43de549a972f78489edb60097bdf5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618937825, "uuid": "89a1df3e-3d52-4eaa-9b92-dcebe89d031d", "comment": "Malware payload (Dridex)", "value": "f4a1e8e8e158d8c6784874451dfb2cc1b72572c435d870b60b2c610631657393feb4ea35487fa2f9a6f50077c8b96d89", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618937825, "uuid": "f5024d12-cd9b-47d1-b48c-daedb2c35ae3", "value": "45F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618937825, "uuid": "79457ba2-3d77-49c4-8174-d60c544d5541", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618937825, "uuid": "63e9566e-d5f9-4cf7-87eb-f8b9ce34e8c5", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618937825, "uuid": "53e8af25-69cd-47c4-8c42-7903aaadbb6d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618937825, "uuid": "1503ffc2-e4d7-43f3-8170-ef92ffd69e87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618937825, "uuid": "85a421c7-ba31-4de6-92bb-d9dc5ec3b23b", "value": "0e4556421060857a710b760deb14c2c7abf09c221b794e291f0e59445d47eaaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5edccccd-a1a3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618900860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618900860, "uuid": "658e5dc4-e0a4-42bd-bc7a-7a923c23cc09", "comment": "Malware payload (Dridex)", "value": "e81aa8a2a443da2cde02cc73f4fc45b4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618900860, "uuid": "8f098a4f-0efd-4a6f-a8d5-8e64af3f4a83", "comment": "Malware payload (Dridex)", "value": "0e4842a5e52dc96267b86838975ed07e020f6d2553f9151b27293a19baced6f0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618900860, "uuid": "5c32a494-9c5a-4ef3-8107-3dea37de8976", "comment": "Malware payload (Dridex)", "value": "1059cb348142863c46b326e5abd50760c3e8f816", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618900860, "uuid": "a160f486-4685-4977-aa34-7ae936a576e1", "comment": "Malware payload (Dridex)", "value": "b3be1bcb66e70dbafd24ab5506db9e0d4c31b8660903348d01e62f44033e43dcf5667821d67d0682391bf5e3ad0a917c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618900860, "uuid": "78df5565-5976-4991-94f9-2e3b1668029a", "value": "B0F3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618900860, "uuid": "0156a8c0-8908-4318-8226-b3d780f811b7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618900860, "uuid": "cab471cf-b4a1-4da8-91ec-df7c5194eed5", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618900860, "uuid": "ee8953f7-295c-472f-8b64-f0113815f91d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618900860, "uuid": "52fcb7c0-d675-42b3-a5f8-0698a4b0e1d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618900860, "uuid": "4865b376-8805-4728-befe-b0901e9c4c9b", "value": "0e4842a5e52dc96267b86838975ed07e020f6d2553f9151b27293a19baced6f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321b7f4a-a20f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618947171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947171, "uuid": "cb882250-7cc6-429c-a2a4-2f20405ebf48", "comment": "Malware payload (Dridex)", "value": "0896070ccc6804fa65c21aef57653085", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947171, "uuid": "05d2ee91-f412-4d33-91ee-e747bed11ce8", "comment": "Malware payload (Dridex)", "value": "0e5db3cfcf67fb2fd851e8487ad309f98eabfac7b6c1086366cf5fdb4bd21b9d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947171, "uuid": "1f1c9b25-32f4-4a3d-a574-0f1033747762", "comment": "Malware payload (Dridex)", "value": "176a787430351421f4a47beb2c0707147f95945f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947171, "uuid": "c8cc077f-352e-4884-9974-f7f619b79ce0", "comment": "Malware payload (Dridex)", "value": "76f66a2344af43a2d5ee42e688cfb3b56e171625226b50fa98661c473ab40f71d6d1784849ba1d10c85c85ba5cbfe891", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947171, "uuid": "ea760760-be7c-43ee-80b5-9c586acb388d", "value": "BFF3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947171, "uuid": "15f349d0-b513-4cda-9775-34103f348ad2", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947171, "uuid": "83404b1d-6c75-42bb-97c6-2d4e2e771b48", "value": "3072:fwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:fwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618947171, "uuid": "4b2fd80d-1e30-4dc2-abf6-1dafe51514b4", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618947171, "uuid": "c4e399ae-0557-45f0-b8bb-e529323d0133", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947171, "uuid": "d9b7122e-53f6-471c-a9f8-41fb70e758e3", "value": "0e5db3cfcf67fb2fd851e8487ad309f98eabfac7b6c1086366cf5fdb4bd21b9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36430e0a-a1d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618920549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920549, "uuid": "7c9f0ef2-5008-418b-ac4d-c7a1377d1236", "comment": "Malware payload (AgentTesla)", "value": "d60bdc4ce9f86b0797bf7312b8b883b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920549, "uuid": "8655f1de-4971-4bf8-a7ea-512dbeba9f2c", "comment": "Malware payload (AgentTesla)", "value": "0e8dcf86827981e1a10f081aed896cb9b70083b800e8ada54159afbfa9fd2814", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920549, "uuid": "aea5adc0-12ec-470b-a9d2-409f953824c8", "comment": "Malware payload (AgentTesla)", "value": "123db9766101ab6a9cf02f863fa8a303aff84458", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920549, "uuid": "38c716e2-5bb4-469e-a068-6ca6224bda66", "comment": "Malware payload (AgentTesla)", "value": "fbf699a05e9b35da31e41f2eac81f52cd15890af1843266353967f9f47df60f1dde53dd97bb18afe0cb423a098fb37b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920549, "uuid": "4c13a39c-4a0c-4b12-878b-3df429be2680", "value": "F803C3AA24907159D9E309B42D62FC743F28A7709C80D10DE466864CCF86BFB74ED9DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920549, "uuid": "01bf0a28-819a-4270-907a-69d4968dd5e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920549, "uuid": "a3889501-d5b5-4c5e-897e-506cdb6574d2", "value": "768:HjCbe16i6KfMNtAWY7WELsQa4a8ChNCjy3U3Lshh:Hj8eI2fMNtA7gQMhwjP30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618920549, "uuid": "a44882d6-097c-4289-96a8-e6fe514a05e0", "value": 39504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618920549, "uuid": "87e13318-23d7-4747-ba70-734102f3b472", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920549, "uuid": "0c740c4d-f147-4fe0-bae7-790d5a300a66", "value": "d60bdc4ce9f86b0797bf7312b8b883b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b0eb82-a20e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618946692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946692, "uuid": "203ec2a4-d8b2-4ea0-878c-e0b3701914a5", "comment": "Malware payload (Dridex)", "value": "a586a4544db1c17eeaf509400e500796", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946692, "uuid": "805a4e9c-980f-4e00-b1c0-4bd0107d49df", "comment": "Malware payload (Dridex)", "value": "0e99f2605d18ecdcc5a482ab8ead58353e17cd042b213fa8dc31abfb83bc300e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946692, "uuid": "9b8762cc-1a8c-4054-89fe-ed5f5bbf6ade", "comment": "Malware payload (Dridex)", "value": "eacf3c13bf85331d3eee92769dd9d3c5f81a0f9c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946692, "uuid": "564b9a0c-125f-4c2d-a6a3-5c4146ea85a0", "comment": "Malware payload (Dridex)", "value": "a4eb374dc04ae0d09368eb001be25fcd94a5b82fdd91dec83ade84e5ab87b422d0b0744fe2075fe44dc452f3f07c9fbf", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946692, "uuid": "a807b953-cd6d-44b0-9021-4c0ff84d15c0", "value": "00F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946692, "uuid": "a6d14249-42a9-4965-b468-8421e70be35a", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946692, "uuid": "2472b36e-8a23-4acf-85bb-5d0e5951b845", "value": "3072:ZwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:ZwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618946692, "uuid": "29fd6847-0815-4cad-9f31-d8288de07d31", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618946692, "uuid": "077e672f-eabe-49fd-8b5d-bc883fc71121", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946692, "uuid": "168b62f5-9816-4207-8439-fdc54f34ae5b", "value": "0e99f2605d18ecdcc5a482ab8ead58353e17cd042b213fa8dc31abfb83bc300e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c001bf-a1e2-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1618927828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618927828, "uuid": "d0c9fbf5-235b-48f4-af53-e524d1b94c21", "comment": "Malware payload (RedLineStealer)", "value": "a6cfca097972daa91b665d521a708e88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618927828, "uuid": "18635206-a834-4c71-9366-5aea4ee3d809", "comment": "Malware payload (RedLineStealer)", "value": "0ea09371893c99ae78ae7f4e84ba3830f0be24837c8aeb3b947e23a3ec342218", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618927828, "uuid": "635fbcc6-5d00-4538-bd6e-6d6214e06ee1", "comment": "Malware payload (RedLineStealer)", "value": "00de28bc745b1ac890775113510a1418fc468cf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618927828, "uuid": "a2cf4617-6095-45a7-8fd3-78dd821bf309", "comment": "Malware payload (RedLineStealer)", "value": "3c70489796665d5d8d1ed4bf3014f3114b10f088caa60e76c74c92524ed0b2ec4c9e7504a88495dfe5d923ecf0d90cd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618927828, "uuid": "3d337b8e-f1c3-46bb-addd-3e2f08751071", "value": "5312F925B788D371CDBB1A32ECB353408670E7900467D99F57C9891769F3F289AA22F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618927828, "uuid": "4bd857a5-1757-496c-b007-5f553cb16098", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618927828, "uuid": "c3f0edce-4b70-4752-831e-1e4874a8a139", "value": "192:mBksuL9MuIK8eMZZ3W93Vnjdwqzu3/cKxrP:nln8eMCFnhwqavn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618927828, "uuid": "e4989b05-e9bc-4329-b86e-f5ba74f6805d", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618927828, "uuid": "8ebc85f8-88b0-4eb9-bfed-2c28d6a0f597", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618927828, "uuid": "478be0d8-7855-4af6-865f-1c12a0e226ae", "value": "a6cfca097972daa91b665d521a708e88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f9d5302-a1e6-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1618929638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929638, "uuid": "1d05812f-c54f-4fa4-a62c-dc76419f5401", "comment": "Malware payload (RedLineStealer)", "value": "a71f7986a1d1e24fd5459f6e918c0396", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929638, "uuid": "0d5c5b75-e611-4ad4-a517-e5a25aa8e58e", "comment": "Malware payload (RedLineStealer)", "value": "0ec174a5cdf206bf5f09827b927e8f788a515a65be1bcc470f5187c87cec82d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929638, "uuid": "6cdb86cd-b676-473b-94cf-6940d4ddffd5", "comment": "Malware payload (RedLineStealer)", "value": "4f57406b5f9a3c2032e335c3357faab681ebea74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929638, "uuid": "34cebeb3-20e4-41fe-8f9b-96f4d55f188b", "comment": "Malware payload (RedLineStealer)", "value": "b6f21ce2dae65b8b6d7ac66f3c9b40ad3a9b60ae37cb6d21e7c45d6708c07e6e0f218f2ac78875613f7e533605bdf51d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929638, "uuid": "c987fa8e-2e5b-4305-ad71-c4229ba02ee3", "value": "43120A18ABC4E671CDB70A30ECB3A7404B70E75044A7D69F6AD944176DE7B180A937F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929638, "uuid": "a2877711-c24b-4561-8be3-a1c1bcb01f87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929638, "uuid": "f7d37ef7-2d12-4314-a177-6a419589ae88", "value": "192:RpBksu7zHNQKS05eMZZ3f93Vnjdwqzu3AlgUOkhR:RmHd5eM5FnhwqSQlgUnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618929638, "uuid": "b5c31f29-3c2f-4f9d-b361-142b8871f2a7", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618929638, "uuid": "ca82c4c3-40ef-44d4-bd45-5d64a6fe6d60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929638, "uuid": "151f07af-9e21-4c41-8541-8480e616bb5c", "value": "a71f7986a1d1e24fd5459f6e918c0396.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02688a0c-a1c8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618916597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916597, "uuid": "7627b0f9-daf6-42ee-a1ce-18da94c20458", "comment": "Malware payload (Formbook)", "value": "8e76e36ecd9c1cf7815a895060b1faf8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916597, "uuid": "13854675-90ed-4c11-8c3b-5d45fd9437ca", "comment": "Malware payload (Formbook)", "value": "0ed349a732a4c26e6d9fd8d7311239bf86dc676a77ea6fe73c58a676373814a0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916597, "uuid": "c39e61aa-1c9f-4bff-8fee-419b93b6a2f5", "comment": "Malware payload (Formbook)", "value": "808b8c09768912bd4305904d4919489c98b75ed0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916597, "uuid": "b09b287c-b23d-4e05-bd7c-226111d09114", "comment": "Malware payload (Formbook)", "value": "0aca9bd1748ab71a2333f2ee9b744d7b371cdd5030795ae460b28198adb0d432d620e0cb419b9fde891c829ab445571f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916597, "uuid": "8cd364fd-d5e3-458b-8a37-20b60a676812", "value": "2BC4BAACC48742E88F89ABB86B1F2F85114C7A6EF744A5337234977527E2C7B501687C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916597, "uuid": "e8455dee-119b-4a1b-8179-3c3ce831ea96", "value": "6144:gjilZjUIjFo2bYl9zdi4+D2OGisQWzoy1Q2xwFV07XXABCkq/mnJJhvMQNIUzPt1:gGFS3Gn9jtbTRun+Gtz4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618916597, "uuid": "1a73a8f7-a516-491c-8aa2-ce368a913fcb", "value": 586458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618916597, "uuid": "be62446c-66ef-43b5-aa33-6154c6616fb9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916597, "uuid": "b02a3310-c6e2-4467-adc6-cd170f497a93", "value": "Ordine di acquisto GM004868.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d0e248a-a199-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618896643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618896643, "uuid": "283af8dd-59d6-4172-bfbc-ae9d453274d1", "comment": "Malware payload (Dridex)", "value": "b94268ab1032daba281e9d9f4407676f", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618896643, "uuid": "24880bf2-6129-4d18-a101-2d2e54812abc", "comment": "Malware payload (Dridex)", "value": "0f01fd5896b88ced79f6f611de53a20385c7a5b2f7e443ed58bc5e449e768a29", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618896643, "uuid": "3cda4421-bbab-4d0c-91bd-6e4321a3d950", "comment": "Malware payload (Dridex)", "value": "36e85ba5240d9f22b6736244637484b5fa129aa3", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618896643, "uuid": "35db143f-fba6-47d4-9ebc-c8b9183578bb", "comment": "Malware payload (Dridex)", "value": "35e1955e2dacdf8cf8f8f792a9a52f0fc44205ae28a85a401a3f0d2fa2764a5ad717d91c7712dc94df43a3618ea1f463", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618896643, "uuid": "0b390722-bd20-4a03-9f53-4f9b141a354a", "value": "35159D113681C03AD5721A318D25E6F909AEBC218F318ADF77D83F6F6B356C14A32766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618896643, "uuid": "1bab76be-ea3f-4a6c-a5ef-977af10ba3fc", "value": "dc93d67ad7943a17151bf2b40b7ad960", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618896643, "uuid": "3e2bab9b-21d7-40d5-b3e1-e7ba8e2712c9", "value": "24576:LC/P+Jzkw1zr1ClPHFvBpjcSfBPK+9vRC72iQMpv4Ny6CCm4GyV:LW+Jzk20lNvBpjcSfBP79vRmfv4NjCno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618896643, "uuid": "0529672e-ed10-44ce-85a4-20dc65a5d3ad", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618896643, "uuid": "8dafc0f2-699e-47fe-bef6-6710e7d0cbe5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618896643, "uuid": "67dbd5fa-6ac9-4c99-b232-348f14f1b259", "value": "0f01fd5896b88ced79f6f611de53a20385c7a5b2f7e443ed58bc5e449e768a29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf31eaf-a21a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618951858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951858, "uuid": "c9a6c8d8-e04c-43f8-b3da-585aae92145c", "comment": "Malware payload (Dridex)", "value": "bf43eb8e794535efbf1189e2e71a5f13", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951858, "uuid": "18dbf503-0428-4b34-ba89-98115b45d567", "comment": "Malware payload (Dridex)", "value": "0f4f435e907be518487301faf464912bc823415978142aeb667b2d50e8fbc4e5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951858, "uuid": "3f5f3c22-0676-45b3-b42f-74fbec7e9578", "comment": "Malware payload (Dridex)", "value": "09546cd7f11435cc4fd6af0a73bdf52078e6fce8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951858, "uuid": "f5a8b254-7c3b-4abe-befe-f80502f0174a", "comment": "Malware payload (Dridex)", "value": "3a5d14f87531d395e5bd7dcc9fb1bdc545506743001db2e2e76c575e98bb478505195231d8aed4c1ae5b774f10def3bb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951858, "uuid": "d77a3992-721e-4114-844a-dacf0f1a865c", "value": "B4F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951858, "uuid": "0646b9b5-ab66-4d03-982c-5257a3edea97", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951858, "uuid": "3996c8ad-55c8-46e0-93c0-117e7d0d48ea", "value": "3072:CwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:CwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618951858, "uuid": "0c42a60a-952f-4487-a5e3-acd9c3c5cb97", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618951858, "uuid": "ba45e195-a5ff-4ea7-968c-36671d8b31b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951858, "uuid": "0263938c-e10c-4a9c-ba62-53a678e08c09", "value": "0f4f435e907be518487301faf464912bc823415978142aeb667b2d50e8fbc4e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a7a960-a216-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618950477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950477, "uuid": "b6f2fb88-e71a-4901-bb06-2ceafa1b915e", "comment": "Malware payload (Dridex)", "value": "0d75e24adec7a1615f1cf14f4d92aaab", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950477, "uuid": "c5b0009c-e7bc-491b-90e2-55a889c71b53", "comment": "Malware payload (Dridex)", "value": "0f6fef60a6715fdd8f5f3f11cdb647aa9a43632c3d40723fa8b3f76f694ca9f9", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950477, "uuid": "3e1fde1b-334f-41d4-92c6-8c6b70afae36", "comment": "Malware payload (Dridex)", "value": "27ce39a8ec93b0a1538febc613815d616f82575b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950477, "uuid": "ccc02b5e-f981-4708-bc7d-17f90078127e", "comment": "Malware payload (Dridex)", "value": "132c62f523d0976592c1fe2ab7d09666c1af84104a86eb6358fb137c1419c82e8765532d667d7d21638f864af74c7c45", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950477, "uuid": "4500da14-f9c1-4ac7-b555-7e327d2ffc39", "value": "DCF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950477, "uuid": "fe9251b8-2063-46b5-896b-537206a5d736", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950477, "uuid": "3591502e-db16-424d-8079-7fe748280c99", "value": "3072:1lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:1lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618950477, "uuid": "4896855b-8ec6-44b1-b2d8-6d318a498537", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618950477, "uuid": "1b90e3a7-1a15-4e2b-85e3-a98d5b0b4044", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950477, "uuid": "490ea0f4-2cc6-4eed-87e8-32e49d69cf2f", "value": "0f6fef60a6715fdd8f5f3f11cdb647aa9a43632c3d40723fa8b3f76f694ca9f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f8b61e-a21b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618952338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952338, "uuid": "709d5a36-0bf8-40e3-90ee-ebb5e272f6d9", "comment": "Malware payload (Dridex)", "value": "be7433e0bb65828681761202d35dbda4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952338, "uuid": "83394062-9d02-4eb5-a799-d5fa340b0c1a", "comment": "Malware payload (Dridex)", "value": "0f89a347c20455feb1a8ec0ca68d40fd8f9fc12b86aa663f8401bc874ace629f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952338, "uuid": "eca48659-e55c-4666-bd18-2dd9948651c1", "comment": "Malware payload (Dridex)", "value": "ae75dc7feef3a2f62539e5b8537bf928eea83b46", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952338, "uuid": "26c212cf-febe-48dd-8dee-49f00dd90c60", "comment": "Malware payload (Dridex)", "value": "fd3795c209317bff15526e4d063d3adff8bc03bef3f0f6c9b2b518a466a81f2b8d83986a9b2cfddfaaca2104cddab470", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952338, "uuid": "9295368a-4459-43e8-ba42-81fc613d1479", "value": "CBF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952338, "uuid": "dcd32b31-495f-422e-8f58-218e3c28bff1", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952338, "uuid": "8c46ca8a-7c68-4d1d-bf58-2ab44a6297be", "value": "3072:NwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:NwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618952338, "uuid": "fdadce1e-e005-4af6-84bd-2ce419bb3c97", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618952338, "uuid": "3be3bd0e-73fb-432e-bdc4-40f6e6c27b6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952338, "uuid": "7cd320fe-ab0e-4091-8f95-ede9d3442218", "value": "0f89a347c20455feb1a8ec0ca68d40fd8f9fc12b86aa663f8401bc874ace629f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a68b504-a22e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618960607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960607, "uuid": "23e44743-ebd5-468e-8e24-8961276a78e0", "comment": "Malware payload", "value": "2f18f7815bfcbb32e3c8dbe414f3bfcc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960607, "uuid": "834581c9-a677-4c25-bf34-38a7278d8a3c", "comment": "Malware payload", "value": "0fa890313c60fd4d739feba13f43928a34319fd1dce504097d1b2b55b60c67de", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960607, "uuid": "85c8c79c-0772-469c-872d-5ada7e4fe1a3", "comment": "Malware payload", "value": "0cce11aa0044a00c2872816c2f866c59ed60f999", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960607, "uuid": "e6bea26c-f8ea-4cc8-a5fd-6ea4f42bc8b7", "comment": "Malware payload", "value": "dcc2e1c45b52c9e124080844597a1384fb1da0b66d03fd91632e1f9ff82dfa0aa480e7bdc38baea952af94d87c453fd5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960607, "uuid": "39d33459-159b-49ee-99b9-be155ad3dd2c", "value": "B5F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960607, "uuid": "34f7060c-c693-4ef7-9476-f7181049ae79", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960607, "uuid": "7c7a18e7-4bc9-475b-92ea-b7c2b6a7c919", "value": "3072:YwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:YwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618960607, "uuid": "cf0c9ddf-7814-4ba9-b1f5-68974f340751", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618960607, "uuid": "d81e9e6c-a0a7-4edf-b901-9c787c841d2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960607, "uuid": "0f05eada-a8af-42b1-a4c9-b4c7734d318e", "value": "0fa890313c60fd4d739feba13f43928a34319fd1dce504097d1b2b55b60c67de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ca626a-a173-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618880204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618880204, "uuid": "020b5ed6-af7d-42a7-8971-da8da436db52", "comment": "Malware payload (Dridex)", "value": "072392e4b50585ad27d63ec73b19ccea", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618880204, "uuid": "2b83cf9f-fcd2-4a96-92a4-8b19a6130ba0", "comment": "Malware payload (Dridex)", "value": "0fcf7921085f10ed25c8999d7449d8277c8f25709646d427cf975d2189590c66", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618880204, "uuid": "28346cbb-f4f0-4e1a-a83d-0370479dc74a", "comment": "Malware payload (Dridex)", "value": "32e7f35dad25e1babbe43114171f935e95c2b92c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618880204, "uuid": "61d2e581-0aa9-4edb-bf1b-704cb06fa3dd", "comment": "Malware payload (Dridex)", "value": "0cff3fa32441b11daa92b107f07b02501a9c22da875f7e9edeeffc8986a75f74d4cf1f37c970dab44920dc59599dad28", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618880204, "uuid": "2279cfa7-b616-4696-9314-3db44129090f", "value": "D2F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618880204, "uuid": "96940bf6-d59d-4dba-9981-b1bf0de0eb15", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618880204, "uuid": "273a6fe6-44f8-447c-952a-95b5645f32c3", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618880204, "uuid": "570e4676-5cca-4ef9-ace8-9b57d8384f11", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618880204, "uuid": "7bedda0d-1052-4c5d-a314-3972d1acb4cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618880204, "uuid": "fc3e5a75-3532-465b-bb14-39cfc3c64436", "value": "0fcf7921085f10ed25c8999d7449d8277c8f25709646d427cf975d2189590c66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d938a6dd-a1e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1618931130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618931130, "uuid": "18aa02a6-b7ab-4136-87db-52d5e8c1b2c5", "comment": "Malware payload (RedLineStealer)", "value": "a7661a5ec9b683b95b33fb394a6e0a47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618931130, "uuid": "4e0b67ee-fd18-44f5-a0c3-1cda58299570", "comment": "Malware payload (RedLineStealer)", "value": "0fd0e22880e9c1cdd38789bcb74f9755b88e4205e7d7946256395d7dc0ff9c6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618931130, "uuid": "58c1e7d6-e6d5-4857-a434-96e77408b6c5", "comment": "Malware payload (RedLineStealer)", "value": "4f8f976273da0920d068624bd914a2239b039fa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618931130, "uuid": "33801cf0-b429-467a-8a8c-0fc6ee543fc4", "comment": "Malware payload (RedLineStealer)", "value": "e96ae03f4579cebe834b11744b3ac6b60e492128e7bd4c43fbcdc71adf5da211e2d69d563fbba8f2e4cf12f4d6206977", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618931130, "uuid": "fd9c8db0-96a1-47f0-91fc-ffe054f98006", "value": "C9121A19A388D2B2DD7B0B71ECF3A3904370A74040B7DA9F5AD989076DF3B5486922B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618931130, "uuid": "f31c498a-d426-4800-ab2c-80977d50f289", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618931130, "uuid": "c8f5b1b9-1f87-46ea-8ecc-e2038a442473", "value": "192:2BksufPY82gQv5F41tgeMZZ3N93VnjdwCzk3K6Q9E:a82l41tgeMXFnhwCAa6Q9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618931130, "uuid": "eac6ba57-7f84-4f1b-bf0e-6b1ad8e2afcb", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618931130, "uuid": "8cdb8b4f-0eb5-4482-960f-f3ef5099fcae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618931130, "uuid": "eb175705-5323-4ea2-a7bd-d0b4131f09c2", "value": "a7661a5ec9b683b95b33fb394a6e0a47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29299ff-a207-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618944031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944031, "uuid": "ff22d457-7018-4fbb-9f10-200a47c02970", "comment": "Malware payload (Dridex)", "value": "e226fff3a0e671a445fc3da8f24d1c03", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944031, "uuid": "b39011c8-2d6b-45fb-88a9-767bd24da68d", "comment": "Malware payload (Dridex)", "value": "0fd6415e9d0113da29db3de2ed46fe5caaa1981f24c1351cecaa30f80a29cb46", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944031, "uuid": "7bb3356b-bd05-4137-9a00-473d2f989a17", "comment": "Malware payload (Dridex)", "value": "33cdc0b81113abc5aa25ad1715ee2e6831885740", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944031, "uuid": "b7bec3fb-6d68-43db-8732-a1b22ff0ee0b", "comment": "Malware payload (Dridex)", "value": "7167c985cc6f4d1b54cd3ecd4b2f909bc5cce605b2b0532cd4aa6451e1c22c0237524db891beecdc9c620b4ef5601e48", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944031, "uuid": "cb3525ea-5311-48f2-b0e5-f5d0bff1b923", "value": "76F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944031, "uuid": "32cb5d5b-9075-4d7b-a489-cee153c31965", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944031, "uuid": "3a367fb9-ec59-4cab-bea9-77f40d3de4c9", "value": "3072:Glpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Glo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618944031, "uuid": "5e6ef7fa-9cd0-4b3d-8b47-92891da443e4", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618944031, "uuid": "b83ee658-aaf7-4659-90d9-69799f995851", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944031, "uuid": "7e24ed80-c908-4b36-8089-7b78f5638305", "value": "0fd6415e9d0113da29db3de2ed46fe5caaa1981f24c1351cecaa30f80a29cb46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e133316a-a20f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618947465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947465, "uuid": "247149cb-6247-4908-b98b-a42decf302ca", "comment": "Malware payload (Dridex)", "value": "1a645e4cf6a591bad4021da1cb52fb74", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947465, "uuid": "9154233f-43b6-4711-9249-9a895f68c92d", "comment": "Malware payload (Dridex)", "value": "0ff3b05e78893f421106fe8173830275969be3f939efb210b7ec01e5d5a5d26b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947465, "uuid": "a000ffed-20c3-4818-a35e-0923360de985", "comment": "Malware payload (Dridex)", "value": "b283496ee45f47f25853991f34e448be4c1998dd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947465, "uuid": "9b3acf16-6421-471d-8e1e-75be5e115c00", "comment": "Malware payload (Dridex)", "value": "f2ae6361b133c2375129295bb2c19e33a59a6b20cb05bf923c802f1f75883128d351e0409ab92dc0ef43d0c6f59d8bd6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947465, "uuid": "082de04b-d2e5-4510-99e7-366299b26925", "value": "DBF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947465, "uuid": "dd7bd349-bae9-4926-8e26-60da88d88879", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947465, "uuid": "75180918-cdeb-4662-9fbe-1ac84ab583f3", "value": "3072:XwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:XwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618947465, "uuid": "f041df7a-d47d-4cc4-9427-515df871c5d7", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618947465, "uuid": "589bc16b-c153-4d30-a7dc-8e095fd87fe5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947465, "uuid": "a11b570f-0693-42df-bcfa-a423b2ccdacc", "value": "0ff3b05e78893f421106fe8173830275969be3f939efb210b7ec01e5d5a5d26b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c710a3-a20f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618947395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947395, "uuid": "49f1befb-bc8d-47cf-8251-dbf1bee2cdbe", "comment": "Malware payload (Dridex)", "value": "c60d70b0c48237af7dff24ebc8c3b83a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947395, "uuid": "2cb92999-bbaa-4ca9-ad41-0de0816c022b", "comment": "Malware payload (Dridex)", "value": "1023414ac5687e3b39d2ab7848446b10c9403d78736e1b688d689cec9f162499", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947395, "uuid": "d52b0ffe-72ff-4605-84f0-e439b3f22476", "comment": "Malware payload (Dridex)", "value": "411d8da628f123f43b36bddec3c63301fa761d1b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947395, "uuid": "08e6e0f1-2888-4190-8fa1-5eb16d99b7dd", "comment": "Malware payload (Dridex)", "value": "cc589c7840d7b3cf57966fef9ad539aa5dda643a76767584bf345c4df3d23249414ae847ae0a2ef39b7ce431fcd88802", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947395, "uuid": "4ed30454-c689-4475-9090-98b14df841ac", "value": "E7F3C088CBB3E4E6EFB3937966F85E1B4A1574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947395, "uuid": "62571d05-880f-4946-97d2-1839d3414924", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947395, "uuid": "1f1ed459-8629-4fc5-924f-f7f91d342f6f", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618947395, "uuid": "d8b8e480-82b6-40ea-be96-50237f67ef6d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618947395, "uuid": "d0a5fe22-80ac-45ce-a1ae-8d23837b8bdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947395, "uuid": "aed631de-c423-42f8-bf59-138585b85359", "value": "1023414ac5687e3b39d2ab7848446b10c9403d78736e1b688d689cec9f162499", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "116ba4dc-a1df-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618926500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618926500, "uuid": "27849c2a-63b3-4f56-882e-814a6de415e3", "comment": "Malware payload (Dridex)", "value": "f26d4392c3b87b4b5a47f54286f62c4f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618926500, "uuid": "f2269257-cba0-473b-899b-cf128a106839", "comment": "Malware payload (Dridex)", "value": "1068b1462f1b84c2a624dbaa1c4c99fb417d906a0bd0a04e2cdf7710ae5de638", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618926500, "uuid": "6b6b1cd4-2769-4697-99f3-a07caa60b264", "comment": "Malware payload (Dridex)", "value": "9ec545e8e9ae0b9e90553e061e7a61c299669c3a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618926500, "uuid": "1da49861-b6b9-471d-a242-689e11802d78", "comment": "Malware payload (Dridex)", "value": "831575ac62cd697707f283f3643d460ac171df334e82d9540e8cdd9865bc701d7bb4e7ccf7094b667e5fb54cd07bfdfb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618926500, "uuid": "3c3eb85f-0265-41e1-8645-cf45918a91b4", "value": "44F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618926500, "uuid": "70621f5c-3edb-4f4c-bf71-2eae3d17c1d5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618926500, "uuid": "3a309c59-0f5c-4fb7-8e66-e51d7f7c4470", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618926500, "uuid": "740b161b-c7be-459b-835e-bf0b21d083af", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618926500, "uuid": "5b03dce0-22f6-4863-ab7a-166deb93f973", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618926500, "uuid": "df3dd464-0e5f-469f-8154-7f7abac6d94e", "value": "1068b1462f1b84c2a624dbaa1c4c99fb417d906a0bd0a04e2cdf7710ae5de638", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c46c50-a176-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618881412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618881412, "uuid": "98e3648f-6362-4109-9306-31b0bb4c53d0", "comment": "Malware payload (Dridex)", "value": "9e777851e947a5d0bfed518011314031", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618881412, "uuid": "ca2c1a88-c72c-4df5-bb1d-10925f1dc7ea", "comment": "Malware payload (Dridex)", "value": "1087276a709e5c8357a8fa2d62826c84f13dcd70bcdd280584daf377c621c3d9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618881412, "uuid": "1d18c92c-6314-42e8-9e9f-0bda8109f230", "comment": "Malware payload (Dridex)", "value": "19c04b3786bb6542694cd27e50beb241cf56ae43", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618881412, "uuid": "a5113bde-9bf7-4903-aabd-1886e86623f5", "comment": "Malware payload (Dridex)", "value": "061971e3103ca2553b6d129904fa087b2c9a818c97d8a2b602541b95060c89022cdc374fd4b9d605bba287f7c12907ee", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618881412, "uuid": "b1b799bc-0f04-4230-bacc-3925c7fc5ad7", "value": "6DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618881412, "uuid": "bd2c2e9e-d331-4631-9c44-918db5afbce0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618881412, "uuid": "f8da5bca-28ad-4a23-b2bb-d9ad09e45379", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618881412, "uuid": "20689531-e607-424f-b274-34113910e82e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618881412, "uuid": "5631fea1-05d5-4ca5-a9f7-31c732db6909", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618881412, "uuid": "68f60213-fe48-4765-833b-4f5c90e7cc05", "value": "1087276a709e5c8357a8fa2d62826c84f13dcd70bcdd280584daf377c621c3d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b6d51e-a22c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618959961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959961, "uuid": "53ce69d3-9700-4313-8a3a-141cfa88a90e", "comment": "Malware payload", "value": "1678e3bce76431025c30128732456ef9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959961, "uuid": "c13e4a20-cf9b-4256-813a-400e01d0be05", "comment": "Malware payload", "value": "10eb4ba77a2e13caab165fc6f9edbe77fb7e06f7168d26707f334ab9532819f6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959961, "uuid": "79fb1723-60e5-4eef-a00f-00fe5dd420d8", "comment": "Malware payload", "value": "3bb8f03f4311ff3b2faee39b17551cb45d5318b3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959961, "uuid": "c5097efb-555d-4b6f-9c51-0044c9aaca04", "comment": "Malware payload", "value": "b1329471057868680c88399a9c235b6261bbf5c04a1e56b4ff7be8b61f626bbc40dde8ce902711e62fd0f55d359087cf", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959961, "uuid": "078de745-0bfc-41a9-b9bf-376453405607", "value": "97F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959961, "uuid": "e3212b3a-30db-4478-afc7-8ac2dd335662", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959961, "uuid": "544074eb-5944-429f-b54d-3793a670b2dc", "value": "3072:aA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:a3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618959961, "uuid": "4857fff5-4523-4243-a561-a3b9be54b8af", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618959961, "uuid": "2859e42c-f8bf-4fa3-ad3a-7b993fa2c8cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959961, "uuid": "abe21e97-1917-4906-9143-479586e06afd", "value": "10eb4ba77a2e13caab165fc6f9edbe77fb7e06f7168d26707f334ab9532819f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3746d7e6-a225-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1618956628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956628, "uuid": "a6b1f730-c8f1-42df-a5a8-6ba5d401299d", "comment": "Malware payload (RedLineStealer)", "value": "3f3b8350527c4e4059697d4970478945", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956628, "uuid": "6a6db07d-793c-42e9-ab1c-07a376eb04b4", "comment": "Malware payload (RedLineStealer)", "value": "1107ed4434adf7c7730e6e9d30e7d6d2a3e009c3462af17e063a162d178f8db9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956628, "uuid": "bd198748-43d7-4d46-9284-8b8af735144a", "comment": "Malware payload (RedLineStealer)", "value": "410c3a5e1d2b08321c5f24fee1a7b378a59334b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956628, "uuid": "9d584fdf-0bc9-4f8e-aa55-a8dc60202d9a", "comment": "Malware payload (RedLineStealer)", "value": "06b1330e2086a9b938df4863b6b6612d81502f8cbd3aa5b987acaaa65ddd3777f2fe2e7f82f692a51c9325a91032be23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956628, "uuid": "dbee0ec5-24b0-46b5-bc75-4dd3b2e4d434", "value": "0D345C3923685714D1BF9D77E660212502F4EDFB6032EA864EF3B87A1D767816A009F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956628, "uuid": "4ee0370b-2981-4366-9818-0413ff6d4811", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956628, "uuid": "5e3f2789-ab8d-433d-bc3a-9b85ffbddc91", "value": "3072:5Yv2cF2Jt39WHyf5VyddZz+lK5YrRA32r97V80+zuupgHb2nRhdrqOG:fcNy/yRz+8sP9q0ajdQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618956628, "uuid": "65c05622-69c8-4a31-ba5f-dcdc93f88a8b", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618956628, "uuid": "23ddf8d0-0a53-47d1-8452-171ad9fd32a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956628, "uuid": "f8b03cad-52e2-45ed-8bcd-3193c11d4203", "value": "3F3B8350527C4E4059697D4970478945.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae40e43-a16c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618877178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877178, "uuid": "e30c5d5b-a5e1-4d1c-b575-fc0f5f21eb8c", "comment": "Malware payload (Dridex)", "value": "2db5cf9c14db6febb2c89f48cefbb341", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877178, "uuid": "98bffc5f-20e5-443e-a276-998ea20cd254", "comment": "Malware payload (Dridex)", "value": "11200ec928b5d430a92bc90d4532e6964ce07d5c39f0a4506315590f15eecf32", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877178, "uuid": "f5fc446e-21f1-4ffd-8df9-d226cd5f56b3", "comment": "Malware payload (Dridex)", "value": "cf0b0f349bed93e332c815c43f8c480b1a916990", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877178, "uuid": "809372b4-e12b-4b04-81b7-576a3bb3b343", "comment": "Malware payload (Dridex)", "value": "172cb78e26e336693d23104e699fbadb8805f719c348cef7761d980bbc2456f741bd0997e2c09ff70d9140f42c5a08d0", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877178, "uuid": "96630101-7b73-4a84-ac3b-8f4da48c695c", "value": "F5F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877178, "uuid": "5643acaf-8bf7-4003-ad09-034f20836f90", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877178, "uuid": "fade9cac-d39d-4574-b1cb-a04761b8b1f4", "value": "3072:vWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:v42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618877178, "uuid": "18f4cc1a-d93c-490e-93bb-19ecb1f56710", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618877178, "uuid": "aac22432-2ab1-4a2b-b2a8-375e9566745b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877178, "uuid": "62b6538b-3463-410d-93d5-295eff8921d3", "value": "11200ec928b5d430a92bc90d4532e6964ce07d5c39f0a4506315590f15eecf32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc415b1-a1c7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618916426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916426, "uuid": "afcc408d-25a2-4ae0-91f0-2c442caec692", "comment": "Malware payload (Dridex)", "value": "a83e3067752a20b3449051552110b013", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916426, "uuid": "5e5d465c-8cee-45e9-882f-d34c41219697", "comment": "Malware payload (Dridex)", "value": "112302ebded6aed2eca67f61b366b1dc039e9ea901cc457d75f4823a95e538ec", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916426, "uuid": "3b9e0f50-f238-4279-915f-de4fc22c3715", "comment": "Malware payload (Dridex)", "value": "e542f6fb01246f2fde0d75920088fe110df2eadd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916426, "uuid": "82201c6a-5d55-4e84-b042-8c3d6458b77a", "comment": "Malware payload (Dridex)", "value": "2528a6bc4373597e0931fe55b61636dfab22eddeaae469d606680d2b6fae0a58204cd7337ad17d8c2ad32e4918287a72", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916426, "uuid": "f7341ff2-3360-4d62-9060-835abc709f2c", "value": "55F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916426, "uuid": "40577ca6-f250-48d0-873e-3338f4484aca", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916426, "uuid": "87285a91-49b1-41e5-ac6e-480d0a4259cb", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618916426, "uuid": "2958a877-ca27-47f1-8377-9b38d944e942", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618916426, "uuid": "8dc314bc-b5dc-40b6-834b-f9cc43dcfeb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916426, "uuid": "24756d22-dd4a-4b7f-b4c6-3bc3a4add857", "value": "112302ebded6aed2eca67f61b366b1dc039e9ea901cc457d75f4823a95e538ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8145233d-a221-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618955035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955035, "uuid": "a6bc3a8a-7fc9-429d-a949-4e0e9067fa3c", "comment": "Malware payload (Dridex)", "value": "4eda6be069a0278be0cc1cfd6dd14d7b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955035, "uuid": "277d14c2-b524-433e-bcc3-7453be55dce4", "comment": "Malware payload (Dridex)", "value": "114a606688b5bb02d534ec65b5f17504576d1d8d86c53a87c735e13f8f3c5a7b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955035, "uuid": "7c656d91-c6c3-4938-9dc1-4fe10c619322", "comment": "Malware payload (Dridex)", "value": "c5c81269cc454addeff3a84f885866a8306505ec", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955035, "uuid": "8bf1a238-87f0-40e6-bdce-306b69fcbcfa", "comment": "Malware payload (Dridex)", "value": "765b07271b373c19b7d3e74f81908a3475c44e6c96b3d3f1d8ad8a694712763bb7f03d0623168a4311b1992421a3a5df", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955035, "uuid": "c50ab135-adeb-40a7-8bf7-2c20450a53ed", "value": "6AF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955035, "uuid": "43bdf7d6-ec60-4c52-8752-b63860875bd6", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955035, "uuid": "ee842d93-20b4-4b3e-a987-0d182ffcfa3e", "value": "3072:/lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:/lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618955035, "uuid": "497535c0-b3bd-4510-8865-e47b14d2dfbd", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618955035, "uuid": "4bc8afc3-cd85-40f2-849f-dc0569899031", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955035, "uuid": "b9533585-002f-4eb7-9aa9-eebe192f5240", "value": "114a606688b5bb02d534ec65b5f17504576d1d8d86c53a87c735e13f8f3c5a7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3470fd6-a21a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618952139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952139, "uuid": "8bf0c554-e878-4a28-b4ce-f6ea4a5e4f3e", "comment": "Malware payload (Dridex)", "value": "a889f3fa701fbca4d4a4e8a2da6f358e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952139, "uuid": "3ec8a129-a731-46ff-8a7c-7077720c92f4", "comment": "Malware payload (Dridex)", "value": "11b6b8b3652da8fedb30840ad544f8733170d836753b6da0134b1cfab4e17d9e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952139, "uuid": "21779a20-547d-40ab-86b1-fe22d74b8fd5", "comment": "Malware payload (Dridex)", "value": "81639200bb22b8a939ec39a9ee7abfee8c31314d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952139, "uuid": "c09407f9-5ba9-4fd6-ac70-2af3d06680ec", "comment": "Malware payload (Dridex)", "value": "c7e0ab427cc10857cac03c2a1c9bb393158d3190a7b8b91758bce10b5cc12be2343d5f238ebf1abccc4a1859e9569aa0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952139, "uuid": "9cb43475-e1cb-4207-8dfb-674538eb1179", "value": "E4F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952139, "uuid": "f0681976-64bf-479e-8b4f-d7d082918662", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952139, "uuid": "a0fd5e71-8923-4b59-a745-4af6721771a2", "value": "3072:IwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:IwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618952139, "uuid": "8130462e-5269-48b6-b20d-7a8ecdc6ed37", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618952139, "uuid": "fe2f57d8-7872-4142-ad18-e5354882d6d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952139, "uuid": "81ac1f36-1f45-4d32-b8f6-d837620e4eb2", "value": "11b6b8b3652da8fedb30840ad544f8733170d836753b6da0134b1cfab4e17d9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a177ba-a209-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618944707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944707, "uuid": "0d2bc9e9-426a-40f4-8d78-0a238314188b", "comment": "Malware payload (Dridex)", "value": "d01a5e098c6ae46055ebb3e0c6e93df6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944707, "uuid": "94bcce72-d128-4393-8f97-1fc4166b2a5b", "comment": "Malware payload (Dridex)", "value": "11c66c087e2cc70117992e4299d6bffecdcc0ebb5d521d56a413f82f4f1344fd", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944707, "uuid": "2a057c19-13ca-46e8-8109-a4c9bc4e13f4", "comment": "Malware payload (Dridex)", "value": "48ddd062ae242dd4d0e01b78935f06935131a7f7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944707, "uuid": "7808c810-ca9e-408a-81f8-985c1bf93fad", "comment": "Malware payload (Dridex)", "value": "cf7912d79bf24b904e24cfded095540f8572a6b8deb3b8f2445fcf0332822ff08b5ede0d2405e99c5bb1117664dd21a5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944707, "uuid": "13eeec5a-90a3-4070-8f46-e3610e467f7a", "value": "1DF3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944707, "uuid": "832ec8be-9219-47b7-960f-6e8910a1013a", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944707, "uuid": "87e797f8-7c57-4c14-8ed3-07e117d3b397", "value": "3072:BwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:BwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618944707, "uuid": "10eef622-fafa-4a61-bf08-f77cc35cb9a9", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618944707, "uuid": "9933cffc-4d77-4641-ab3c-7553446bfbfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944707, "uuid": "d3806781-93cb-48d2-ad26-396c4ad434f4", "value": "11c66c087e2cc70117992e4299d6bffecdcc0ebb5d521d56a413f82f4f1344fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "567c3983-a1d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618920603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920603, "uuid": "eaf83f99-e362-492b-94a4-80bdb3b5ca50", "comment": "Malware payload (Dridex)", "value": "7c0804ee870b0bcf2fc583f77289a506", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920603, "uuid": "2e3e82ed-b9df-4204-acfb-8c0b84683823", "comment": "Malware payload (Dridex)", "value": "11ea3bc291bf26c5c2b72a6a0dab9e44c5a59da7264f9ceb6d87af8b3444a486", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920603, "uuid": "2bcb874c-4413-4a23-ae5a-f134a1c26dc4", "comment": "Malware payload (Dridex)", "value": "d79a27a5088426dab00e7520cb75a0b269de7fec", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920603, "uuid": "37d4ef5a-7c6d-4f69-a413-7ebf419d4a1d", "comment": "Malware payload (Dridex)", "value": "5b046c30d3dce30751d10b30184f7ccecd6f36a00f37b344391cbeb73a3bf3f05ec84b89cfbf7f8f74b0b969b45f54cf", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920603, "uuid": "a1774560-61c5-4420-a468-138c0854177a", "value": "10F3D081E78FF451E10A6DB59CB27A2B3E31BE481689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920603, "uuid": "98466c08-e1a8-420d-8066-9bf6023e5fb9", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920603, "uuid": "fd701b0a-4202-4814-9b56-7b59997428ab", "value": "3072:xwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:xwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618920603, "uuid": "a70ba647-e64a-4e3f-8cf8-4ee3a1cec787", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618920603, "uuid": "6cdb7ca6-194e-4599-847e-1a140ccaa2db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920603, "uuid": "eb8fa13b-f092-4087-987b-280973507cbc", "value": "11ea3bc291bf26c5c2b72a6a0dab9e44c5a59da7264f9ceb6d87af8b3444a486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d62f96c-a1ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618917581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618917581, "uuid": "ae5215e6-d66b-49f1-bf2e-6b52cf3d3ddf", "comment": "Malware payload (Dridex)", "value": "bb3edc4aa43168d90a8b05ca5a02bcff", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618917581, "uuid": "7cb41492-24e0-4ccd-a0d4-4512e069149d", "comment": "Malware payload (Dridex)", "value": "120b7d58134fb57cd38a00b0911dcb49eb31b0ed1ccc562abaa93b034e6b6f2d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618917581, "uuid": "0c6ab419-087f-4d79-879c-43969afe482c", "comment": "Malware payload (Dridex)", "value": "748ea612548cb91700884c986932222aa0b1f44c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618917581, "uuid": "cf1402b1-d946-4753-b662-3dc0d5338b5c", "comment": "Malware payload (Dridex)", "value": "7e41872fa078f9a8628bb7193161ce62a59ddb114d608ed5d37167b21f54714dd1a2cababebd0baa7902e6506f9fee81", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618917581, "uuid": "2e7732fc-7af4-434c-954c-e9fc61d40d1a", "value": "5FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618917581, "uuid": "d1c64817-dc65-4d62-9148-67980b537181", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618917581, "uuid": "b255227d-5e87-475e-b99e-9a0521f7a2b0", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618917581, "uuid": "ef51f684-ab62-48f5-b43d-a11a53c309d1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618917581, "uuid": "857c40c4-a960-4b16-9c29-21848cabad20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618917581, "uuid": "72a2b408-282e-49cd-9ef2-be64075dfa0a", "value": "120b7d58134fb57cd38a00b0911dcb49eb31b0ed1ccc562abaa93b034e6b6f2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b82389-a211-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948163, "uuid": "b463b42e-c9b7-4c05-8973-3d8d85585a0f", "comment": "Malware payload (Dridex)", "value": "230299ddc9c91bb97b672d76603e2290", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948163, "uuid": "e6bdcdca-b8d6-427b-93c5-751c5759ca56", "comment": "Malware payload (Dridex)", "value": "122bf7f137c7f0a1cccdfd19129191328c028950e1a0a7825516144e4a9dbd5c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948163, "uuid": "473ab8c0-ff46-4b56-ac41-5e1126f76dcb", "comment": "Malware payload (Dridex)", "value": "ae21f763f85dd344107a2a0beaa1a873e8dbfceb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948163, "uuid": "fa6b86aa-0029-4075-93ea-2c7c7934d499", "comment": "Malware payload (Dridex)", "value": "aa250d9dcde00db9471e8296eea56bba33b136267ddbbfa95e86fc3c6daca74cf92aad12731ef4ee1c3aa13f79b8d4a7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948163, "uuid": "4c859801-2943-4db9-8e92-352806bfb26c", "value": "ABF3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948163, "uuid": "742376d6-fd25-4193-8a15-91fea0031af3", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948163, "uuid": "cc1de330-855f-44f4-98ab-e7cc914f8b6c", "value": "3072:AwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:AwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948163, "uuid": "8d277cee-38ed-43eb-9499-6c0c5e2943ec", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948163, "uuid": "f1d11fcc-e4ef-4b29-a51f-e905ee35c289", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948163, "uuid": "97cfbce9-afc3-4c0d-8a17-ec457039b1da", "value": "122bf7f137c7f0a1cccdfd19129191328c028950e1a0a7825516144e4a9dbd5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33358d8c-a1a4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618901217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618901217, "uuid": "bd4da90c-4f87-4c8f-ac10-aacf16c9e926", "comment": "Malware payload (AgentTesla)", "value": "84433c191fc2ca51fab75f0379e880a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618901217, "uuid": "fd3efe54-9d94-4c31-aab2-dee3a0336dbc", "comment": "Malware payload (AgentTesla)", "value": "12358ea9cdbee9d710612a3689bf7a41c8761c4175c803a39a791d584d1734a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618901217, "uuid": "b52d871a-e5a6-4441-8970-2dbe13f48df5", "comment": "Malware payload (AgentTesla)", "value": "26fb456d561d162ec36140022434edc0db744fe4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618901217, "uuid": "af13bfc0-9d17-4fd1-9f17-d0e2eb58b5a1", "comment": "Malware payload (AgentTesla)", "value": "ab5bc4707e61d3d3855370a0a93c0231a5d11a163dcf4dc6c7f00b4a2bbd54e6b6f2a7bf957e09005b97a191753963c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618901217, "uuid": "59ef8540-04f1-45d1-a6de-cc2c471441ac", "value": "AA457DC5B150F8DFD81B49B2EC295C3020927DAED255C20F509F771A6ABB343B45EE2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618901217, "uuid": "e2890a3a-aa81-4cef-8615-bdf85161c616", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618901217, "uuid": "be1891a5-e7f1-4599-89a0-ba3642d9695b", "value": "24576:eSL8Xl0p3bdSaEl9k1Q0gSXxYMUbuea7Yko0/OnP/B8cC:n3bsaEly1Q0NDULa0q2P/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618901217, "uuid": "a7c2e005-0435-44ac-83e0-9b508b5b6629", "value": 1166848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618901217, "uuid": "2befc432-5648-4a81-81d6-d952bbd37592", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618901217, "uuid": "97ff0226-8f41-4543-9176-9db5ca387d77", "value": "KUTIPAN REVISI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1469cfa5-a16d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618877543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877543, "uuid": "19ab89f2-3113-478c-8802-eb83709780b8", "comment": "Malware payload (Dridex)", "value": "9c8fba375460571dc77e6f88818aca2f", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877543, "uuid": "46da74ff-fe60-4073-b099-2cb552538abc", "comment": "Malware payload (Dridex)", "value": "1293c7053eb9fb872b43c7b0bdace6615cfb50dbf8876ffd267938266d141d9f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877543, "uuid": "51894a1d-4735-4c00-b1b0-1ed5ed013aae", "comment": "Malware payload (Dridex)", "value": "f41ec86dacf3395bb39457d3dbf9406dffc435cf", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877543, "uuid": "f7f671b1-5953-4be3-932f-476078cb4595", "comment": "Malware payload (Dridex)", "value": "257cbb8286d71c7dfc0901b8ca07662190f3ddab6d234397a6c7de878de2df8d360e9322a564b0758026ffa03452d2ac", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877543, "uuid": "8850727f-d5d1-478e-b006-18494cdec7d2", "value": "88F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877543, "uuid": "adc32185-413f-4f8a-a075-7ab9d25b9f7b", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877543, "uuid": "af5d57eb-9c13-4731-a199-cb32cce6e97b", "value": "3072:uWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:u42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618877543, "uuid": "f50c3e8d-e298-4fd4-b557-1127b1128597", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618877543, "uuid": "2f0b0476-3d53-4648-890b-8d307e344e8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877543, "uuid": "201ed0e6-0b4e-4973-b5e3-71a249dad115", "value": "1293c7053eb9fb872b43c7b0bdace6615cfb50dbf8876ffd267938266d141d9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3143d3b2-a203-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618942016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942016, "uuid": "aec9fc80-a297-4a34-9d2b-be799f91a511", "comment": "Malware payload (Dridex)", "value": "fb414aaa4ff91ae675326f61648b8430", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942016, "uuid": "4a49edda-8da9-45d1-8c23-0ec5b9617ecb", "comment": "Malware payload (Dridex)", "value": "12b411d472cac7143738333439fa019be31ba732ddfac76a60447236f470c371", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942016, "uuid": "59d38bfd-a613-403a-b277-a5177bbf1f48", "comment": "Malware payload (Dridex)", "value": "c61d01f987ec877038d3c67d8d76cdf9077dd4ba", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942016, "uuid": "0c3768e4-f138-4d4b-8142-b1a3dff31bad", "comment": "Malware payload (Dridex)", "value": "92af2d78dfaade8a478032204fc7760314e9ab8731f3c563c32f3064ebbb5872d474223ddfbffbdbb700d892fbc44749", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942016, "uuid": "8161f460-98c1-4dcd-b2c7-77556283814f", "value": "07F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942016, "uuid": "7f31d58a-3745-4be7-9b3d-4a563af5204f", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942016, "uuid": "a46b51e3-83da-45ab-a813-7406faeb9ccc", "value": "3072:zwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:zwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618942016, "uuid": "8e5798f4-4d48-47e2-8eae-09510c076f1d", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618942016, "uuid": "de067325-4d11-4673-96e7-deca816115d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942016, "uuid": "720aed9a-b558-4b82-9ec0-070259391dba", "value": "12b411d472cac7143738333439fa019be31ba732ddfac76a60447236f470c371", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba5d1b7-a213-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618949120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949120, "uuid": "5b761e24-d608-4b06-bcfc-3f7d73294bd9", "comment": "Malware payload", "value": "c6a821cfd42764aac888c712993a0eea", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949120, "uuid": "d1ec1208-d6f0-4a97-8759-5bcd3a1eec86", "comment": "Malware payload", "value": "130a0b4bb2acffb1a89814dfc3aba94a1dc2fc513269f5ade274f73064600cfe", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949120, "uuid": "22d41e4a-3a93-4041-a9d9-5a82dcf66a25", "comment": "Malware payload", "value": "e17ef88c3b1515be5ee3e9019ffa497269fe935a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949120, "uuid": "1ab71b9b-a222-4dea-8cf0-5af44396a900", "comment": "Malware payload", "value": "a30a5a6baa89c0e197767c294e35544c2a236735eeb6ee5f41127f8010e34686edcf425054c67a976b3e6ca2800572ba", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949120, "uuid": "472853b1-874d-4ec8-9367-6d1f51bb11cc", "value": "EAF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949120, "uuid": "ee3c3d18-e66a-4204-80de-6b3fe8b1c4da", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949120, "uuid": "033bd92e-2bb3-4e1f-ace9-2f7d8ed52ad4", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618949120, "uuid": "4a4326da-78a6-40b0-bcb0-4d967fe40820", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618949120, "uuid": "fc5abbcf-7b34-4c69-8e65-f44e48d35e7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949120, "uuid": "9c4b695f-d6d9-4fd4-8e73-50e454f5d7d6", "value": "130a0b4bb2acffb1a89814dfc3aba94a1dc2fc513269f5ade274f73064600cfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892e3af5-a1b5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618908662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618908662, "uuid": "8687f110-3df8-40b6-aab8-a4e617e9c9b9", "comment": "Malware payload (Dridex)", "value": "b91d2bd4373a907cb24594d5af93d2ca", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618908662, "uuid": "14a0593d-507f-4097-86a7-9ede7b6a1945", "comment": "Malware payload (Dridex)", "value": "131249bd102bf73a43dbd2247984ad8d6e485862331f08f7e5e8f6d4626b38b3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618908662, "uuid": "ab50388a-674d-4cec-a6d5-1c1b2f6ba096", "comment": "Malware payload (Dridex)", "value": "5245ecab5394f7be75f1fd36e1e86010a947eff8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618908662, "uuid": "e96c1d2d-a021-46a7-bf5c-5cf5f65a7cf4", "comment": "Malware payload (Dridex)", "value": "4e6929d525684d7ddf7dd008d6af2f825e43d6c2342d0e65f1d5818a8e49f235f912b1114666e25cc998cb129fc2d432", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618908662, "uuid": "f4b08d7e-ccf9-483d-b2b7-8e222df6ce26", "value": "9AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618908662, "uuid": "2516abae-b10c-443d-98d2-75bb5292b3e4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618908662, "uuid": "a0dea365-ea50-42d8-ac1c-83f32e34bc45", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618908662, "uuid": "4b01ee76-a250-4274-904e-171ab590ee7e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618908662, "uuid": "c43a7206-f087-4fbb-b393-8c5ef42a7226", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618908662, "uuid": "ca867428-3991-415f-a4d4-38b1aadc74ed", "value": "131249bd102bf73a43dbd2247984ad8d6e485862331f08f7e5e8f6d4626b38b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae025f0-a1ff-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618940260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940260, "uuid": "2b4630e8-1ec4-4a7c-bec6-28da33d5b7ef", "comment": "Malware payload (Dridex)", "value": "e6605440048d072c90cb91ee08e1f384", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940260, "uuid": "1df9aa75-e016-447b-9cf4-3f31246c1f79", "comment": "Malware payload (Dridex)", "value": "1320e918ed29e7bf0a0e1ced5446fb771dd87d22aa6c65d3837222d7a6ca9e7a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940260, "uuid": "28d109b9-68e9-4431-846e-3c63dbb0f28d", "comment": "Malware payload (Dridex)", "value": "1bbd87925559f5aaa767f5d606c23522f10af7d0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940260, "uuid": "48362d82-f576-416c-bdcd-a62b3fcfef50", "comment": "Malware payload (Dridex)", "value": "c7796fc65bd3f0f437da2b8be848ae6deb85c9d53899ea79ebc1ef3118b75bf268f9e5c4504ef717b7efb973738fc151", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940260, "uuid": "11fa93c6-aa3a-4696-a2e3-2397349fc547", "value": "A2F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940260, "uuid": "c4627473-d408-4d3f-90b5-9bef5e6b3259", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940260, "uuid": "e6971130-5d9b-4ec2-9b11-db01ab8b6e89", "value": "3072:uwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:uwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618940260, "uuid": "c249d9c9-d23c-4f5f-bdd7-d5aef7aa97d7", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618940260, "uuid": "31773aef-8c04-4afe-9a94-ebab86cdaadd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940260, "uuid": "4c0a5131-3b1b-47d6-9a1a-723872c58a0c", "value": "1320e918ed29e7bf0a0e1ced5446fb771dd87d22aa6c65d3837222d7a6ca9e7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1e61b5-a205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618943002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943002, "uuid": "90cacce4-e43b-4b46-9c3c-d1cb65848969", "comment": "Malware payload (Dridex)", "value": "f521297712be70aeaf1113867f8a6d8e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943002, "uuid": "4e0ec87b-ab1e-4269-ab54-6690016d4c91", "comment": "Malware payload (Dridex)", "value": "136990964b719cfd08123e625ac8643932eedd85ae622548396880ef366dee24", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943002, "uuid": "03760415-c63f-4320-b401-24d103f8390f", "comment": "Malware payload (Dridex)", "value": "da708f2d060c6deb1c9ef1e13e28862aab2d44e6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943002, "uuid": "6851ae81-7776-4f9e-89ac-7d0642cac121", "comment": "Malware payload (Dridex)", "value": "20246ed5cc4689fc34a42ea4c9b182b2ee6191ccc878a227180c9f937b38a552b4b51a8f1b38f107ad43b5fabf7ab254", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943002, "uuid": "f78d5c0b-d947-444c-b460-b1aca0766ba8", "value": "F4F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943002, "uuid": "6c804c86-816f-4a8c-939f-615bd0dd20ca", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943002, "uuid": "470cd4ee-5ee6-40e0-84f8-afd109ae458b", "value": "3072:TwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:TwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618943002, "uuid": "0a6701e9-d4a7-45e8-ab28-e7ce21981b21", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618943002, "uuid": "ecdff626-9e05-460b-93e2-c7c8d2472849", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943002, "uuid": "25e659a3-9bd2-452d-8f41-fcfdb1edf56f", "value": "136990964b719cfd08123e625ac8643932eedd85ae622548396880ef366dee24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13083425-a22d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618960004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960004, "uuid": "0f89912e-b397-45e3-837b-69cf34277978", "comment": "Malware payload (AgentTesla)", "value": "ccb228755fcc596d8083f8ce8b503b15", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960004, "uuid": "e0940664-a588-4992-9f8b-51f35784190e", "comment": "Malware payload (AgentTesla)", "value": "1380de440ca758466aaad40d56e12fabe4e6db5f17d40c85abfb8d4488d9bca3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960004, "uuid": "da8e6bb0-c4b2-489b-96e8-d978eaf72020", "comment": "Malware payload (AgentTesla)", "value": "51d0cd2e7fa70f5a9bfbaef7fe1ffc5e98845630", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960004, "uuid": "7436ecd6-849e-45e5-9d7a-9ba17c870107", "comment": "Malware payload (AgentTesla)", "value": "5c6db3a2ba1e053fab4b3efac4862eb9e16a6e6b54d58b8a099a2b57be6b8b1c05fb74e9c5d0e6c751a28ee600e62cd3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960004, "uuid": "1141b192-ca42-4b1d-a9b8-97f8f329b187", "value": "7EC4231CD94772C8445375B5500783D1F2BA81EF27EC870FABE1F6AB88E8B84A7925D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960004, "uuid": "454e3993-5c69-4358-b0b3-26ccffc0760f", "value": "12288:KlbONeBdk/jeY3dlLkWD0xESH+S+CyPsnZkZQV+3arx6Yts+ktMd:aOL7N1rDFSHv+CyExgK4MsbMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618960004, "uuid": "0e71f97a-b626-4b22-8500-0ccdb1e41eea", "value": 574026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618960004, "uuid": "dd78211b-6a64-4e0d-ac86-3e0c865452cd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960004, "uuid": "6b861de7-720f-4f8e-a70b-379c13eccf0f", "value": "Quotaion 4-20-2021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ea6791-a21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618953647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953647, "uuid": "93719831-afa7-4ce4-97ed-5aaad39da90d", "comment": "Malware payload (Dridex)", "value": "9ce4eab62a65374b6950fcf34c9c0c5a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953647, "uuid": "30ddae0b-a685-4382-8392-068aa0c86582", "comment": "Malware payload (Dridex)", "value": "139fd599537c59aa8cf0020b5ce897db95e4e39eaa80896c7e05348027c6eddb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953647, "uuid": "e1bcc59e-5ec6-4bfc-ac71-d3573d4a1ef1", "comment": "Malware payload (Dridex)", "value": "928f28804e84f410c5472ece076ab68d173a9c58", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953647, "uuid": "240f25f7-a72b-48bb-a72b-28fa8afe5df6", "comment": "Malware payload (Dridex)", "value": "60a6e4fbe8c276e5a93cb79eac210e6ab7281a035aba44cbe9580e21b64c24b19522d2204ad2306e4b04837c915e8e24", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953647, "uuid": "f6d14ddd-996c-4f1f-bf53-3a670d5ec6c3", "value": "E6F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953647, "uuid": "09fdb1ea-73dd-4ce0-9497-3ab36bddcca6", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953647, "uuid": "fbe04f1a-1b56-4b27-9fca-c608605fc8b7", "value": "3072:JwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:JwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618953647, "uuid": "a168a4b7-1af7-4e37-8212-a3b488db30b1", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618953647, "uuid": "fe419975-4072-463e-a872-5d13190d5d2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953647, "uuid": "df5c55e1-866e-4cb2-8496-bb44c75b23ec", "value": "139fd599537c59aa8cf0020b5ce897db95e4e39eaa80896c7e05348027c6eddb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ac47aa-a180-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618886074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618886074, "uuid": "d9a00adb-3593-4fd2-91d4-592d40118b5d", "comment": "Malware payload (Dridex)", "value": "13ab5c7441626a98099f401dc81d5fa0", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618886074, "uuid": "8ed32584-9cd2-47c1-9980-46f70de00aec", "comment": "Malware payload (Dridex)", "value": "13a3f44d1acac77d26c9fe4af59fcfb591d9d6c48af135d3ac62f5c34376038d", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618886074, "uuid": "7f3eb8d0-d852-4684-8226-a124c8cefb53", "comment": "Malware payload (Dridex)", "value": "66a6c2c32203327ca509370cab179fb1bb00b92b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618886074, "uuid": "d53b750e-5950-4c00-95cf-d953535a66a5", "comment": "Malware payload (Dridex)", "value": "aead0ba5a49472e86dbb8d3ff7efd47450ab65905457a21441ea81d4a517d7150d45b089ec620d0f440ae7bc6e9d53e8", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618886074, "uuid": "80b1f6a2-1614-4ac8-ac06-d664869ebd71", "value": "3DF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618886074, "uuid": "785ef5cc-5a9b-4582-bfd3-922b5772ec34", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618886074, "uuid": "0f5b3cea-4e76-46a9-a010-80a589612314", "value": "3072:AiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:reAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618886074, "uuid": "ec874a3b-9ff1-41af-bb79-e84adea0cdbf", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618886074, "uuid": "646a3d23-ebd4-4c8d-b6fc-fa37b770b0e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618886074, "uuid": "d6735e39-01e7-45b9-b36e-d518abf366bb", "value": "13a3f44d1acac77d26c9fe4af59fcfb591d9d6c48af135d3ac62f5c34376038d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b315b65-a209-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618944663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944663, "uuid": "9d941d9c-29ee-4b49-97e6-74a8c0441ca2", "comment": "Malware payload (Dridex)", "value": "36f1c2c1ddb65b062e7d4860baea5be2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944663, "uuid": "e7be040b-cf80-4d2d-b1a7-ddcfb59251ae", "comment": "Malware payload (Dridex)", "value": "13bd8049bbb89f2ffcb4d0f3d80dc09451ae833c7bf8f7c06b00e5c7111345a8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944663, "uuid": "60767e3b-cff6-4836-be57-81d1e36facfc", "comment": "Malware payload (Dridex)", "value": "4e9975abbbeac73b421451274e677d1555517fcb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944663, "uuid": "67264f19-52ad-4a9c-8736-0d35c0fabff2", "comment": "Malware payload (Dridex)", "value": "ee0966d7895d7f8f20dbe3161ed5c4f7f5d85941c9c32d6e0da70f0b81f793b39b8da5c76ef6743a791f2cbf1a31d1b2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944663, "uuid": "72ebd9f7-5837-4438-a44f-5700cc0104ca", "value": "D3F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944663, "uuid": "d013c3af-3415-4175-b34d-4101b00f4a49", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944663, "uuid": "9646f601-aef5-4dda-9b04-8c8f9af52840", "value": "3072:CwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:CwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618944663, "uuid": "b6c56b1b-99e3-4769-b1e9-6314c5319e50", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618944663, "uuid": "e9913452-7193-4f0c-ae39-15b5e58d4023", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944663, "uuid": "185e8b2d-7397-4d23-b738-9985ce721e74", "value": "13bd8049bbb89f2ffcb4d0f3d80dc09451ae833c7bf8f7c06b00e5c7111345a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ce171d-a1fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618940149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940149, "uuid": "6c6b7b92-986f-41a0-b26c-c54b16111e0e", "comment": "Malware payload (Dridex)", "value": "a034a93295606fe8e29d8996f92056bc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940149, "uuid": "dcca124e-1fd7-4bed-a034-a77f49b31deb", "comment": "Malware payload (Dridex)", "value": "13cb116583a60d41de72a6e1872c0e44e31c66867fb2ca6bea675cf514b62099", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940149, "uuid": "a7805ced-c931-4d5a-bcc2-7a2e5fd108c6", "comment": "Malware payload (Dridex)", "value": "557c39264680ff109bca4a1c57306314dfb918b4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940149, "uuid": "542ebe2e-8140-491f-86e0-eb6596d4e8de", "comment": "Malware payload (Dridex)", "value": "1af0ec5019e4c78060e879568447ff6e0d8c1ba7c1b7cc2415983ce69992f4a394b7861311bef40cf6ce375c9b118adb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940149, "uuid": "387ecab6-136d-4a1e-ac3c-79a7d6cc6b54", "value": "65F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940149, "uuid": "de124dd3-268e-4ce4-8e83-5a862fb5205d", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940149, "uuid": "6ee36575-6aac-4d76-82d4-e39b750963f0", "value": "3072:qwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:qwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618940149, "uuid": "6fb6447f-002a-45ba-9679-9c5465dcb632", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618940149, "uuid": "39b50984-1132-4679-bc1b-08995a098806", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940149, "uuid": "c0b89c59-3b01-4760-a0ca-32524efed2f4", "value": "13cb116583a60d41de72a6e1872c0e44e31c66867fb2ca6bea675cf514b62099", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59b1698-a208-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618944412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944412, "uuid": "481d9cd8-a475-4ebf-9be3-40d93bc5b2c7", "comment": "Malware payload (Dridex)", "value": "8bc3cc0195a85a5f98bd3342f1e55662", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944412, "uuid": "46df195b-90da-462a-960b-5540d2c8da4e", "comment": "Malware payload (Dridex)", "value": "13f9cc3f8f84b8585a31f123209a12199a69110bfdb10c4717cb01c86671e9ec", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944412, "uuid": "1f1ed906-3fad-4fbc-af63-638c5feaca8c", "comment": "Malware payload (Dridex)", "value": "5631b14397fc530cebe12745bf04958223cdfc91", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944412, "uuid": "99291627-e92a-43cc-955f-417045c05d5d", "comment": "Malware payload (Dridex)", "value": "d19855db5a8b7ebd9c835912309b44ae0ef3ef4895a7974a022d0b6a8c2266e1203bebec1421d1a92491ab1c2d487fea", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944412, "uuid": "3674047d-e0a9-479a-aa51-4b07f20593df", "value": "70F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944412, "uuid": "42dfa8b8-6aaa-4739-aa79-b6993e25f14a", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944412, "uuid": "d0c46c7b-1c08-4abc-bb53-461aedb594a6", "value": "3072:GwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:GwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618944412, "uuid": "5961c0e4-778b-4230-b663-1bb77b52c595", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618944412, "uuid": "c2068bb3-8d2f-4349-8aa2-7e25f511bf6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944412, "uuid": "fc80e296-50e4-4150-bd50-cac004c12f5a", "value": "13f9cc3f8f84b8585a31f123209a12199a69110bfdb10c4717cb01c86671e9ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "174332ce-a208-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618944119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944119, "uuid": "ca649802-f6af-4d95-a1f2-0cb7079a7250", "comment": "Malware payload (Dridex)", "value": "463f11b533fcbe0c8ebbf4046f5e4e72", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944119, "uuid": "2b3f88a0-a8d3-4616-b960-50ed2c0e48a2", "comment": "Malware payload (Dridex)", "value": "146986d27a9d33bbd29b57080577f963ae887aed1fee343be1fa45855ef72e86", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944119, "uuid": "4cd6bb39-4422-4b49-be35-efc86b2e11df", "comment": "Malware payload (Dridex)", "value": "3df851c328e7f8b3ea5ebef6c92a0e185ecc0540", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944119, "uuid": "b5339e30-7b5b-4068-811c-7d9c9d56a4c9", "comment": "Malware payload (Dridex)", "value": "14dc08ad3fa6160a04cc3455ea1dfff6ca0cf39310e9d26d9bfdf8ae0e6c5ce28057d2710a8c05dcf6cdfc0d702335d5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944119, "uuid": "0f563812-ef37-46fb-80e0-866645f3d7ba", "value": "03F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944119, "uuid": "63ccb9d3-48d8-474f-8d59-38e89d6aaec5", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944119, "uuid": "16f090e8-1a5e-4b20-a16a-2360fe06e797", "value": "3072:vwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:vwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618944119, "uuid": "8a16f456-df68-4d22-bf76-802b84cd90b4", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618944119, "uuid": "cf3e8dce-bb4f-4067-9f6d-213602b2040a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944119, "uuid": "d5f59a0d-d170-42b0-9bd7-3ed6935b4190", "value": "146986d27a9d33bbd29b57080577f963ae887aed1fee343be1fa45855ef72e86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32992e2-a224-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618956434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956434, "uuid": "6dad36f1-8c8f-4a61-a946-9474c982025f", "comment": "Malware payload", "value": "3476b753b9bf17c23a41f24c8a7b8977", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956434, "uuid": "c5fb5c8c-8f5d-4172-87f8-fe50cfe09001", "comment": "Malware payload", "value": "149803d994058e1b63df86ca6c395bbc25bc7fb0d7bc741e1fca577aafad8055", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956434, "uuid": "78602418-d81f-419d-931f-77a3622cf36a", "comment": "Malware payload", "value": "bf2b33e827f5a69e65bed3861384344e571ea3da", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956434, "uuid": "bd08136d-8ae7-428d-8844-c202c58000f8", "comment": "Malware payload", "value": "147dd3f8ed3202d3464dbad7426cde94c052aa735713c98846a38eb8f79e70c36b37e62aac373cd56ef5a224166a2f14", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956434, "uuid": "47c8de5a-9fa6-4b85-ab68-21865f34014c", "value": "2AF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956434, "uuid": "a400f7d4-ba8b-49a5-ab57-fd611ac696dd", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956434, "uuid": "36d4ea56-3b02-4e05-b38b-d730b847b440", "value": "3072:9wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:9wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618956434, "uuid": "84e15de1-156b-4ce8-865f-ddd02d756cf9", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618956434, "uuid": "5bfde695-f019-4fa1-a32e-160cb547c7e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956434, "uuid": "f838fde3-5ccd-4b4f-ba03-f259b4b9c12b", "value": "149803d994058e1b63df86ca6c395bbc25bc7fb0d7bc741e1fca577aafad8055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e514538-a1ce-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1618919408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919408, "uuid": "c42b8d53-25ea-4afc-b16e-cf98abf3cdee", "comment": "Malware payload (RedLineStealer)", "value": "dbb5076bc4604f29fce02c87ce8eec2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919408, "uuid": "45e76c03-731f-49d4-b0d0-6fc525caab11", "comment": "Malware payload (RedLineStealer)", "value": "149cfe6af20dd3b333e87fe3b9d764ca9c62d2ab3846845f2a210b8c3695eeba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919408, "uuid": "c7b3bef9-de9c-435a-9b93-03eb28f19070", "comment": "Malware payload (RedLineStealer)", "value": "e4b79889cfbc590d416feaf5d67c894479ba3e26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919408, "uuid": "1deed319-f048-4fa5-a721-2287f8a6984f", "comment": "Malware payload (RedLineStealer)", "value": "55ab049a71a2064676d2c7d8a27e94a10289c97294fc8ae0c0531dd28be2fb46adaec82d2a84d4c5ee37c5f9873c996e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919408, "uuid": "0e26d913-a9e0-4d8d-b235-e2729cae4ff0", "value": "4AE328E3FAD8944AF4E76DF5A655B2B14D308D3020C1D82A87482E52EA317CBC4F567B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919408, "uuid": "0fd6362b-d060-4c83-a175-3267182d94c7", "value": "04b14c74d128b600565b7582f06e9a4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919408, "uuid": "8cfc61dc-facd-4d56-944a-dd8f5ed20c86", "value": "768:/Ia7FoXriv7zCWbTOJxgbidM/9s0vb1LAiz9GcSfdvBfJpQ2bZ+8tYosjKAvpXSE:/L7FoXriv7zHF9tbx6WquSOIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618919408, "uuid": "22caecc4-efc9-460f-9151-5878eb22e102", "value": 148792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618919408, "uuid": "b940e46e-76d6-4d19-bfc6-de7aa14a63f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919408, "uuid": "d6de964e-9ca4-44e0-aec0-e889b3e854d4", "value": "dbb5076bc4604f29fce02c87ce8eec2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b7a573-a220-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618954742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954742, "uuid": "b0dc5883-8957-4414-9a74-5b2f064bdab9", "comment": "Malware payload (AgentTesla)", "value": "96d26966d0f3c9d1d6bb1159c208afd3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954742, "uuid": "b3003f43-f121-4386-9094-d9c7fc6acfef", "comment": "Malware payload (AgentTesla)", "value": "14f0d7dbc3dae41faac948675df206662c7ae481098064951b6fe134bff265dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954742, "uuid": "20931993-0d01-4f2c-be94-1b3b274c4d0d", "comment": "Malware payload (AgentTesla)", "value": "eefd233390ad0bc1b4d9395cf87e1413e04fca13", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954742, "uuid": "f5a0a629-2370-4b6f-86b2-3bb50ed49bd4", "comment": "Malware payload (AgentTesla)", "value": "fe3863381029002e41b218a0ac85ed078030f9c52c78cbe70cf23042a2459cef8e1a3307aa2516c67f0b2bc0833c114b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954742, "uuid": "dc495b94-ddaf-4ff5-b26c-6807ce675bf7", "value": "F3E4339428A16505D0D73F98203DA6AB37F0EFEDCBE6817815E31491EB83BF6DA5E410", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954742, "uuid": "924f9f28-c210-4f3e-8f15-d82f02d97c70", "value": "12288:Kgh2wt9nygKAGjk0iJ/edywf0Oj1upPePqLWfPK3jESVlQ2:Ke9nlKAsk0Q/acOePDLN3DlQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618954742, "uuid": "89dff972-e249-4805-b3ba-552909c8c4b8", "value": 694269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618954742, "uuid": "7627a4b9-d39d-403c-a87a-127f838d3de4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954742, "uuid": "472cd63a-b4ee-4208-ab16-e388112768c5", "value": "Invoice,.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ef10dd-a1cc-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618918372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918372, "uuid": "b3dc30a8-c7c7-46d8-b0f4-32bf3954f387", "comment": "Malware payload (AgentTesla)", "value": "2856f88478dc39b95425f61091dd1105", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918372, "uuid": "07837428-92c3-43bc-a2e3-b72fa043ed7f", "comment": "Malware payload (AgentTesla)", "value": "14ff14f01dbdd25fa438abb57376747a312007166d6eb67b778918582da01002", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918372, "uuid": "d9b4a5ec-83af-4334-a327-581908f0e988", "comment": "Malware payload (AgentTesla)", "value": "b6a5aa69b63243a0fb6c7051bdcd120a944eecba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918372, "uuid": "2b2e90bc-3540-4553-acff-2baaeef5e9fe", "comment": "Malware payload (AgentTesla)", "value": "063355e6e561704e238cec96c61c74b62ab1f9a6843ffaa9d5acf916154c97b5ab93dc03379a5e75e8e3965217fabf85", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918372, "uuid": "3024f2f4-25b0-4581-8139-432b76592ac6", "value": "01742360F41C8086E3D2CE7E1DFE2EAEDE5021C6817801F7665DCE4A1C87245DB9BA27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918372, "uuid": "f238c754-1ab7-469d-8a84-08f3119d3ea2", "value": "6144:lIq+h5h4tNnzX7R7bsLRIAedfmkuk/PQfB7h4VfSv5Bys89neEYBTwoONWUHwF:lIqcWND7lbsLaAehmkAf7lBys8dmT8Nm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618918372, "uuid": "71c2c7e6-80cb-4e05-b2ad-78da93674812", "value": 337522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618918372, "uuid": "a40f6b8a-1a22-4594-ac55-4854f4877128", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918372, "uuid": "6ed11fcb-8138-4503-bc8d-9178aa8bf8fb", "value": "334# ARD_QUOTATION (2).PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee18058c-a209-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618944909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944909, "uuid": "700cbce3-4dc1-4d3b-913a-bbc09a6da9e2", "comment": "Malware payload", "value": "737b619ca6d0e33d866eb4f4b63777a6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944909, "uuid": "b6f285e1-037b-4594-96c2-fe14fabe78de", "comment": "Malware payload", "value": "1528b32596b4376e17353dfa42cd89ef90cd996ff26a9efbca6effd3a2688d6f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944909, "uuid": "f46b799a-af95-4a2d-bb6c-174277f0b11d", "comment": "Malware payload", "value": "772f25ad91bd90dc35b59c47a42d64d756c18634", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944909, "uuid": "19558db8-988b-4952-a929-a22369f18fa8", "comment": "Malware payload", "value": "c6d7686056e2a2b46dfe173896f039c692f1d48b8f8a312dbf05b07a2cc127c57bb3260b34dd1079b09a1cdcdbf9f987", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944909, "uuid": "8a527abd-3276-4c72-8391-6242f80e9654", "value": "51F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944909, "uuid": "f1682be6-5608-4add-8e32-6639cb6fa134", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944909, "uuid": "053855a7-bb97-4daa-ac7f-b794077f243d", "value": "3072:ewZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:ewZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618944909, "uuid": "8efdfafb-ca2f-44a1-b0e7-5344f5db38f4", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618944909, "uuid": "7f7faebf-67e1-4087-b046-5625976e3666", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944909, "uuid": "647a37bb-f5b2-4ee2-b076-d56af4c9ea39", "value": "1528b32596b4376e17353dfa42cd89ef90cd996ff26a9efbca6effd3a2688d6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6806df86-a1a8-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1618903023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618903023, "uuid": "a59b58e9-1b23-4ebe-8aed-ae025f057592", "comment": "Malware payload (NanoCore)", "value": "dbecba4a6211aba561e0d36f9db4b1d2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618903023, "uuid": "2dd9f112-fb0d-4773-b707-888d536a431d", "comment": "Malware payload (NanoCore)", "value": "153d0278268d1ba4248fcc47b93d6098c023c22ae0148e570e5f97810ae1dc4a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618903023, "uuid": "007f02ef-c89a-4620-9754-1bb8ff23d2f6", "comment": "Malware payload (NanoCore)", "value": "f808acedb937fcf07cd2b2c801a84cf290272b65", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618903023, "uuid": "9dcaa4b3-2b35-4bad-9482-81d20f615568", "comment": "Malware payload (NanoCore)", "value": "4180c09ac0919d695c32b9ab4333426e63b3d437833b4b5356fc6459e845b9c0a61342c72886283ec5efaea2f2952da4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618903023, "uuid": "e641bca9-8850-4e85-b8c8-5d4add589388", "value": "AB54D9E0218F86B6E6058E4D24D4B1855D34FEA730CA8C7563AED674CF69AF26FC4183", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618903023, "uuid": "de8aba95-978e-49ca-bc54-65f93f4d75ce", "value": "3072:9pBrB2BrBXSVCZZjaQi4RNdzFDrqRDAw5wfQ:lVcVXSExi4ndzFDWRDAUwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618903023, "uuid": "62ffb783-8654-440f-9b00-e6854c8c4b65", "value": 302608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618903023, "uuid": "78ee2b43-53a5-481b-a57e-503ef342d4e9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618903023, "uuid": "eb621be9-f37c-4483-87a6-1e9af49f6e28", "value": "180421 PDA Request for Quotation.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4598975c-a1d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618924011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924011, "uuid": "2bcb740e-3093-4f61-9626-92754267cb2a", "comment": "Malware payload (Dridex)", "value": "0b90a89785edd94e2699c7f8ec53f69b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924011, "uuid": "86ca5e3a-fb79-4d26-8657-aee30c6f486a", "comment": "Malware payload (Dridex)", "value": "155a1cc7d02dd1f05d338577d29d1dad20660ee877c3c5be5d5c4298a7ab57ab", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924011, "uuid": "ca65c9c4-d95b-4c6e-97ba-fa527a7eaad9", "comment": "Malware payload (Dridex)", "value": "abb827a045aa13ae9a719bb4d13c11eadbc674bd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924011, "uuid": "35f4bfbb-9b3e-4df8-9fbd-98a0359d120b", "comment": "Malware payload (Dridex)", "value": "fce21651226badf9bfc6d19aa3f9012d93ea7cd3a3377144af2b27de4196c74613274814fcfa01929917078505ce88f8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924011, "uuid": "71a9aadf-ab39-4d84-bcb0-c1dcb40bc895", "value": "4E83F08A1765D40DD9F83E3DE15B153130B93501C8F6E60F1F3E283562528A3FA9BB6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924011, "uuid": "44b0a3c6-6281-419b-9ed7-48a6341e0480", "value": "1536:VhvD0tUn/dDuL7QQ64eyZJViW++poHndClu286aYbgBF+iyffn5:VVjwXQQteyZJAW++4dF286aYbgEfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618924011, "uuid": "062f368b-a351-4480-9fd1-6ae4514cb94b", "value": 83796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618924011, "uuid": "461f6588-980f-499e-a33d-871117232145", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924011, "uuid": "02d7b78a-ec3c-456e-af60-9ac2e627f422", "value": "catalog-193510902.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2dded1c-a22c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618959815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959815, "uuid": "8458aacd-5c43-4dd4-8cdb-aa624b2a2bd9", "comment": "Malware payload", "value": "e5dbe8edf5bda96aafe98919bbc75758", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959815, "uuid": "d1026f59-e8b6-4dfa-a1c5-f3f1d1297ae6", "comment": "Malware payload", "value": "155c3d21240688125e9cdbe701faccfd0a38550518b5dfc11f5f12227901a2d5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959815, "uuid": "491143f1-1ec1-4ef5-b887-a483b3003d4d", "comment": "Malware payload", "value": "7a9d1889d6d501ce750a1e793852c18262c878d9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959815, "uuid": "7c46df10-2c0e-4e6c-b399-fd51407dc1f3", "comment": "Malware payload", "value": "038932625492d05517e412afcd58cfc1ef7b5a5ae95d46b222abb1e8c9cf618db543fa1553af66ec34ff96f231672cd0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959815, "uuid": "880bbcc6-d293-4bf8-af8c-6d155be1efd9", "value": "3BF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959815, "uuid": "da0396d3-5f48-411f-a8d0-1e73dcf529fb", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959815, "uuid": "fa851fd4-9e76-493f-9ebd-6eb558275874", "value": "3072:JwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:JwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618959815, "uuid": "7dcdc869-cd0b-4e08-a8f1-eeeb859c50d1", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618959815, "uuid": "82c850a1-2c93-4094-859c-deef4599ba85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959815, "uuid": "8d33d49e-80ae-4c30-a877-a6dbd2848bf5", "value": "155c3d21240688125e9cdbe701faccfd0a38550518b5dfc11f5f12227901a2d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a27d65-a1cc-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618918419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918419, "uuid": "26ffa7b1-0a57-4217-aa7f-2a34fefb1eb6", "comment": "Malware payload (RemcosRAT)", "value": "5e8ff1a9ec1192bae73ec97729e46d63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918419, "uuid": "2be49ac1-6942-42ec-ad16-0ddc1a4dfc6b", "comment": "Malware payload (RemcosRAT)", "value": "15acacbd5c928108c9db5e319f23e493f45c3a0c8e8b979f7e760675f916ae2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918419, "uuid": "6f38e369-90f0-48bb-949c-c4704930b662", "comment": "Malware payload (RemcosRAT)", "value": "2efd06ad72483238327a9570043159d0ab9ece34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918419, "uuid": "c35d47db-a4d9-4bc4-bedf-bbe217d1b322", "comment": "Malware payload (RemcosRAT)", "value": "6d04af576242e55910e3a7e9e549e71fa6628fec2cb1954c413150958a576e537ca702f43408549cc5acb3c94d4ebcc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918419, "uuid": "d89e5b07-d669-4e94-89b3-ed7ae2fcc82a", "value": "ECE43733D24472D7D4366F7FE80274282171B7F7CEDA828BAE98997D00611BDA36A531", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918419, "uuid": "293cf840-3ddf-47e8-b870-5f478eb7a7be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918419, "uuid": "f67d6dd9-538d-41be-adf0-32adaf720bab", "value": "12288:A8QEzDtIW7I3mfgy7QeCfcz5ZHQePzCJ8G5tpoUzRRRRRJ:AvEzE3mBD/znG6ARRRRRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618918419, "uuid": "ca16a8db-85ed-4f06-a41f-f891cdb21c4e", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618918419, "uuid": "2b3f80cd-3ba2-4598-8cda-fc41d8aee034", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918419, "uuid": "e5732128-cfd2-4dbd-8b9e-0b605a9464f4", "value": "NEW PURCHASE ORDER LISTED ITEMS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06043910-a213-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948815, "uuid": "3520b766-a4be-4fff-bb75-63b93d208d95", "comment": "Malware payload (Dridex)", "value": "a2d3c8e90d856430d8f32fecfe9d1626", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948815, "uuid": "4602116d-d6f1-4b71-ab34-5a6e969bbaad", "comment": "Malware payload (Dridex)", "value": "160b9c8f1f4668e564ef199672fdaf4b0fedc8e6c2ab08c72c1cbe1ca00ea6c5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948815, "uuid": "336b28c6-fe14-4555-89f2-673cf9bc3fb1", "comment": "Malware payload (Dridex)", "value": "d5bba83173f95c7ed6d174b961551669adac0f53", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948815, "uuid": "a8d15e13-867d-44ce-ad2b-72b5bb9b7335", "comment": "Malware payload (Dridex)", "value": "4ad38c914474e97821db7e08c4e4c1802185ea1558fc4f7ef3bf859948275f3da6b4c8ed1f3f6705b5741614953a1518", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948815, "uuid": "22af53b1-b7e6-43eb-987a-c3274e59ff31", "value": "9EF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948815, "uuid": "f6e10d08-4a66-44ee-8b9c-81184b30d652", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948815, "uuid": "609e614e-566f-45df-8ac5-f0a7362fcd98", "value": "3072:twZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:twZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948815, "uuid": "e28b2d08-9ec1-436d-be51-8fa9de127582", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948815, "uuid": "aeb89156-b296-4a50-9202-4e1808c7c20a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948815, "uuid": "f138ed2c-409a-40ce-bb02-86db0d2f32bd", "value": "160b9c8f1f4668e564ef199672fdaf4b0fedc8e6c2ab08c72c1cbe1ca00ea6c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77fb56a7-a1bf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618912928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618912928, "uuid": "d90e6611-f74d-4f94-bbdf-f78b3b679bd2", "comment": "Malware payload (Dridex)", "value": "b03107f71f6de019c6c3024345df8241", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618912928, "uuid": "474f3fd1-a8d3-4f57-9e7c-009bac91e2bf", "comment": "Malware payload (Dridex)", "value": "1621d46b371a642448ced56d4aba112f30c79797353945ecd73030e8461cc2be", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618912928, "uuid": "ad552387-c3d1-45e4-a197-c85325e344c8", "comment": "Malware payload (Dridex)", "value": "968255fa8fd805412e04aaf464395e5a38085def", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618912928, "uuid": "fa03cb84-75dd-4d9b-a734-8bd7b9c05cb9", "comment": "Malware payload (Dridex)", "value": "0501277aa3f61e7b70d8795371211513e66cf10e945fde76b64407ca978389870d85004bcdbb273c406976fa8e4adb4b", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618912928, "uuid": "36b86b45-e046-4c52-b595-463c295cb0fa", "value": "97F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618912928, "uuid": "a0b0bd94-b667-4c0a-9869-12b93bac63bc", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618912928, "uuid": "b66f9570-b062-4753-819f-2799f12c0f6c", "value": "3072:aiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ZeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618912928, "uuid": "0b93153b-3796-4d1d-bdc0-a653cb18a667", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618912928, "uuid": "6a49e55a-061d-4d19-8fa7-056ba62e0470", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618912928, "uuid": "5d3199bc-45a7-4c84-98f0-a3d05823c594", "value": "1621d46b371a642448ced56d4aba112f30c79797353945ecd73030e8461cc2be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e9d5d3-a220-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618954745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954745, "uuid": "4b94d182-fbe0-496e-8ca4-8b1f46b92d6d", "comment": "Malware payload (AgentTesla)", "value": "e6fccd33c9b592039b1b9e68c75c40ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954745, "uuid": "371349b9-921b-4773-94a5-9c2db3eb8ac6", "comment": "Malware payload (AgentTesla)", "value": "16371a4c00dcbafa63e93f577306b41caa10d8a567678a7bb3ed54ae1b4cd993", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954745, "uuid": "18f63c5f-ba4a-41c0-999e-a135e5aaac97", "comment": "Malware payload (AgentTesla)", "value": "dfa11bca779649b45aade346a9115dbae8205274", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954745, "uuid": "3366b3c8-0440-4deb-b214-2df0de599f30", "comment": "Malware payload (AgentTesla)", "value": "7b8b793d5445348a4b06de50faa7a95dbad0fcf150e462d7b1304192c763feb44f4fb2b373de7afe74662e2a04b88e8c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954745, "uuid": "ab0895d1-66a7-4779-ab8a-5dfa4daf906f", "value": "E925F45B253CF5DEF81EBD7289541F20A6706C66823AE207D04F3DD8D97B697EA040E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954745, "uuid": "222f3150-a4f1-4216-802a-e587c99aa4ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954745, "uuid": "4012b24f-9e36-46e6-b2b4-6b864187a36f", "value": "12288:aviTkKcuyYSYgKgGDkOib1ITy2f08h1EpPe2LyfzKNjEiNNQ4r23GRkq92L4fL44:a+cNYSnKgukOa1cc8CPlL1N9NQ49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618954745, "uuid": "30f31895-1dc7-4f75-b68c-74b16d2c8ee7", "value": 1007104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618954745, "uuid": "e496d859-7322-4b72-b26a-9ab05c0fcaff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954745, "uuid": "c29f18f4-75e9-4f47-8d39-7981915ad8a2", "value": "Invoice,.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29eaa76a-a1d5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618922246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618922246, "uuid": "b7c67a68-ae9d-4b7f-a128-2b4af3e1ca7d", "comment": "Malware payload (Dridex)", "value": "968bb6d49db6cb7a9b07ac8f0c6e7054", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618922246, "uuid": "8eb5d8fa-cb34-476c-9668-16be4e9797a9", "comment": "Malware payload (Dridex)", "value": "164989f84a52ebb14a4818e3badff4eadeeb0b252c734f339615af406bcee092", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618922246, "uuid": "2d328523-c27c-4201-a310-58ca4adeb77a", "comment": "Malware payload (Dridex)", "value": "cc49de4c3203690bd1840af9b7f5657d291da15d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618922246, "uuid": "d9675b18-862b-4857-b7ee-5190425056df", "comment": "Malware payload (Dridex)", "value": "c0e052a5b77608262898a3047a4b4281e119eb0d8a0ef24fa4d52bb196dcaca400397b11e5d5840cfa7abbb616f5afaf", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618922246, "uuid": "e85213d9-98ba-4226-853c-7cb0a767f922", "value": "04F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618922246, "uuid": "ca122a33-ff81-4b49-8f70-1751504f85ab", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618922246, "uuid": "96a1a5a3-97da-419e-9ae3-db7ecaf2c1e6", "value": "3072:SA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:S3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618922246, "uuid": "39867a23-0389-4a20-8f06-aa28f7c28fb5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618922246, "uuid": "11146d59-0785-4ce9-be38-73e0e5527d9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618922246, "uuid": "ff29563d-a29d-407f-8685-3922b235ce00", "value": "164989f84a52ebb14a4818e3badff4eadeeb0b252c734f339615af406bcee092", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db1fdc1-a20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618946331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946331, "uuid": "db63faee-8497-44c8-b00d-d662458d239b", "comment": "Malware payload (Dridex)", "value": "e92621ed2433a330544fdbcfc501be17", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946331, "uuid": "12b92561-2146-49ab-8283-1ddd21ac49a0", "comment": "Malware payload (Dridex)", "value": "165e3a93d045fb7f185020939eef8282c1b2b21bdeeb5adf602bef824a6bf612", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946331, "uuid": "90d55b9a-9351-4714-a7db-6607a0b73c64", "comment": "Malware payload (Dridex)", "value": "d7bc61d93794a1f390a72f20680cec7742717c13", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946331, "uuid": "1e0446d7-4687-4bf8-9164-822d0abc7f5e", "comment": "Malware payload (Dridex)", "value": "31d4c00433904b41b67d9d1d09aff1f682b4db5e3513937c20128e7172bfb2e719e6028b3577a2f13434a9dcd1d8921c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946331, "uuid": "ae33e44a-80cc-483e-86ea-78dd8f250451", "value": "62F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946331, "uuid": "fdaf37af-d843-4d6e-82c2-52146c45840c", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946331, "uuid": "7c221a75-94b8-46d5-9d99-260f356d766f", "value": "3072:jwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:jwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618946331, "uuid": "c3d724ce-793c-4fbf-8c85-41cd0195ea0a", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618946331, "uuid": "ad5e09eb-365c-4f81-8592-ca26c7392625", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946331, "uuid": "da591ad6-39fb-433e-bd03-b8142c15ef15", "value": "165e3a93d045fb7f185020939eef8282c1b2b21bdeeb5adf602bef824a6bf612", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8fcb0c-a232-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618962145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962145, "uuid": "58ae9024-2ca4-4169-b66c-3fcdb1cbf57e", "comment": "Malware payload", "value": "34dd831a8432bd45f53421f090623f56", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962145, "uuid": "60745f3c-7207-42e5-a51c-c74bbfe7ee82", "comment": "Malware payload", "value": "16b305e68c824da1ae8d240582122878d708705db03025ec951460427a7f2603", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962145, "uuid": "e010d63c-00f0-41d6-9b2f-ea36a12dca90", "comment": "Malware payload", "value": "1fd5519d8a2d5f9c9080124a3cd5c18f57b4ad5d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962145, "uuid": "6e9da0ee-00c0-4f19-8908-b05d259a9b93", "comment": "Malware payload", "value": "08262955bb343c027b91b4ab5626796b2d920af352b0ef46a8570aaba7725d0fdc04f0967659ec82cba85c31d7183d0f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962145, "uuid": "7b5ddf47-1866-4af9-9021-32f9a8ad9f65", "value": "B2F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962145, "uuid": "acccab9b-04f4-4082-a526-8adf4ac09fd3", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962145, "uuid": "f8b633f0-3a28-4b26-b399-b1717f094c97", "value": "3072:owZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:owZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618962145, "uuid": "4b5f24ff-08b0-492f-aef2-2a24b0e3b91e", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618962145, "uuid": "ab88a288-ddab-4a20-9e57-69a4159b7444", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962145, "uuid": "57b57633-3d5e-4767-b093-c85f474ea10a", "value": "16b305e68c824da1ae8d240582122878d708705db03025ec951460427a7f2603", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63cf9721-a1ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618932651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618932651, "uuid": "6c87b28c-ebed-4548-b87b-c2b57a2dac73", "comment": "Malware payload (Dridex)", "value": "bc78f209c6b508c04319ac8f70bef5b8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618932651, "uuid": "3920ca8e-3b19-4485-9c43-919eb15a2365", "comment": "Malware payload (Dridex)", "value": "16cb58e9b6260a03b47ce72a9d88df7a5c91c65bb6a7c367ef4a0e49d6c93314", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618932651, "uuid": "65c1c813-f754-4283-8268-104f414c884d", "comment": "Malware payload (Dridex)", "value": "297118e3a71dd7cf4494951c89363522f3c001c6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618932651, "uuid": "5b854793-7eaa-461f-9aee-b45eb085e563", "comment": "Malware payload (Dridex)", "value": "71a263cab86a8b57411d56d5d3e2fb4bec1b0a2949c185326ba2e42bd0638ae5667fe8360671ea741283686bf64d2b7e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618932651, "uuid": "dc359b66-97e9-4dd7-82d3-5130f8f1b463", "value": "CAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618932651, "uuid": "53b3ba7d-4ea8-4cc0-83fe-38c4bb06f6d9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618932651, "uuid": "4794a5cb-0fa2-4881-9b8a-20ec18157594", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618932651, "uuid": "f44a6a27-b682-4616-a751-5b59fa40f652", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618932651, "uuid": "2473005d-7619-4c5b-a003-36dfc0b87767", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618932651, "uuid": "6c0d2360-1b56-43d0-98ad-5e09c0384abf", "value": "16cb58e9b6260a03b47ce72a9d88df7a5c91c65bb6a7c367ef4a0e49d6c93314", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e6206d-a211-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948118, "uuid": "239f344e-5e72-4f80-8728-5e3f1ee50bb5", "comment": "Malware payload (Dridex)", "value": "6ababdc3419c7c561a9564e55633eba4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948118, "uuid": "b35d0f05-1f70-4da6-b7e3-a6b2c74ca5aa", "comment": "Malware payload (Dridex)", "value": "16d5cb2d55cfe39ed8dd9c519a4808d7c1acc27d5ac52fccfd89042fda0f15b6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948118, "uuid": "bec26ad6-d7a0-4b49-99c6-19a9b9ad27d1", "comment": "Malware payload (Dridex)", "value": "d4c52df1ebde0d6a751facce527891fe0c17e081", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948118, "uuid": "f3f82279-46b2-43f4-adc9-c1356c762647", "comment": "Malware payload (Dridex)", "value": "a61ce8b08e9b365ab2a374d0df88b85faa1ebf3ba9302fe7af52345c510f33f12942991904c9f9a74e119881569aca33", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948118, "uuid": "27bd48ad-b4b0-49f5-9a7a-1508dfb1fd8b", "value": "B8F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948118, "uuid": "15f03004-1fcc-47ce-bcbc-c03eae651a46", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948118, "uuid": "a61908bd-0207-4e82-9952-0eb938c5299c", "value": "3072:zwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:zwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948118, "uuid": "1bf1ac6a-8f8d-46c1-8591-c4dc041ec34f", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948118, "uuid": "f2dfecee-1a64-4b96-8104-cc7ddbcb74db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948118, "uuid": "1d28aa83-1367-461d-92d1-4927a6ff12c8", "value": "16d5cb2d55cfe39ed8dd9c519a4808d7c1acc27d5ac52fccfd89042fda0f15b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c91dff-a22c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618959827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959827, "uuid": "32d92ef6-8f62-4b95-bad1-8af87a2cbf11", "comment": "Malware payload", "value": "d08da8bf50b7b88472be054ecbd36d1d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959827, "uuid": "6521b406-5018-4344-95dc-d6367cf37c04", "comment": "Malware payload", "value": "17180774637cf947e22733517db6c7de3161cb7d99244dc9847f46008c803b7b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959827, "uuid": "8cb528f3-f107-454f-90f2-c2814d1940fe", "comment": "Malware payload", "value": "f3a4ade70632cda8b9e468b82c2f457708fef2a9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959827, "uuid": "88212b3e-de78-4182-bcbe-e1f68855e1e9", "comment": "Malware payload", "value": "d4a46b1aa46707757bf1a499adf80e09346e4deba04b9bbd1a5e1553d038175502ced1852cd52dfe745414d15bf9ef66", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959827, "uuid": "827fbdb3-160d-4001-813c-aee6e3714108", "value": "99F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959827, "uuid": "aa2b456e-f1dd-4baf-853e-a85de7620362", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959827, "uuid": "fad10bd7-24b6-4e0e-b066-1ff696f670eb", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618959827, "uuid": "09c838ed-58e2-414e-bdac-3f7ce564778b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618959827, "uuid": "da655901-3d1b-4ccf-830b-fe3e0e7d05de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959827, "uuid": "9cbdf0f9-8a52-4f9e-8e9e-1136b8f6c5be", "value": "17180774637cf947e22733517db6c7de3161cb7d99244dc9847f46008c803b7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c18370-a175-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618881353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618881353, "uuid": "a60557f8-9e9c-4625-9e41-e52bfc071322", "comment": "Malware payload (Dridex)", "value": "e33d6d9559f4c760b4c8efa8384cee72", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618881353, "uuid": "61ddae48-21fc-4e94-99eb-8d423b609d81", "comment": "Malware payload (Dridex)", "value": "173ac38c4afd7ec6438f4e685a5b0736ec56514d00b78c323981a273971badb7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618881353, "uuid": "19a139e5-c77d-4774-9321-e61942dfdb94", "comment": "Malware payload (Dridex)", "value": "58ec5a4018be4fd9941f30d440ff753dbd539f17", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618881353, "uuid": "eef2f8df-0730-4aee-8f95-c2779200f76d", "comment": "Malware payload (Dridex)", "value": "611bc29f2565259112912645956a1b9800d1603fde0ef7e7bbbd3fcb10e9569448a98e47c0b9f77c0180dd54361dec94", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618881353, "uuid": "762966b3-9c6a-42b5-bab5-5e00915d29a4", "value": "2CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618881353, "uuid": "533851b8-a526-4c44-bbd8-55e4318ad43d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618881353, "uuid": "389b607a-dee5-410d-9908-04072920c546", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618881353, "uuid": "c614ff36-289d-4797-b87c-722883a22d3a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618881353, "uuid": "a3a836e2-c398-472c-adf4-812b63545a02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618881353, "uuid": "3a055e8c-1080-4b2c-81c6-f3a5f5fa0da3", "value": "173ac38c4afd7ec6438f4e685a5b0736ec56514d00b78c323981a273971badb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e22308-a220-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618954772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954772, "uuid": "8541efba-710b-48cf-ac3b-1ea9b36f460f", "comment": "Malware payload (Dridex)", "value": "509269faf6e9fe446649f0f63dbc4854", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954772, "uuid": "c6de4ace-cf14-4614-ab2c-d388e34db164", "comment": "Malware payload (Dridex)", "value": "17462569717abdf0e381780e563705366f891836656ae81b1f8f1b3f0b4d6dfe", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954772, "uuid": "9e541111-2ba7-4b38-aa2a-b9c6ee369a09", "comment": "Malware payload (Dridex)", "value": "75d0b3ee937a4581b34c100e1ebc5c14783981f0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954772, "uuid": "02869f14-5010-4722-8f76-63e2813fff69", "comment": "Malware payload (Dridex)", "value": "0c3350f1d89a0653c82f419a48637c97b139ec4fc84c8614b4fd117d4c69b6cc7d2743ea5fe516c2c9dfe3ab19673865", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954772, "uuid": "a143e41b-c4ef-40aa-89e1-37290269ba84", "value": "DDF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954772, "uuid": "aa72e78a-1466-4703-9911-9cb8aa465159", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954772, "uuid": "ae29ea57-87c4-4288-9b08-7fb0bee9db05", "value": "3072:nwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:nwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618954772, "uuid": "cb517c59-6151-4044-9a4c-77a86d02dc4d", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618954772, "uuid": "cd258913-8f57-417c-8a44-f6d118fdded1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954772, "uuid": "94d8b37f-2581-4eb1-89c9-8d5c81c120ae", "value": "17462569717abdf0e381780e563705366f891836656ae81b1f8f1b3f0b4d6dfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f937c74-a20a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618945180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945180, "uuid": "29be6209-a7e0-47aa-9b35-93008cc2e7cb", "comment": "Malware payload (Dridex)", "value": "818e18ef774c45141937544fa74848bf", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945180, "uuid": "8e7a3f5d-8c1e-49bd-9f19-1495fd7973ec", "comment": "Malware payload (Dridex)", "value": "175d914ca6f89feed0a28862c3fbdc3a9c679e9837cac2d20205a7c3bce025d0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945180, "uuid": "c68dcacf-af0b-4980-bdc7-7e822e2fc5bd", "comment": "Malware payload (Dridex)", "value": "c542f15c928c8ead72955cea17d5a6c94de8ab60", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945180, "uuid": "508bf17e-6127-4120-bb35-45251df82fea", "comment": "Malware payload (Dridex)", "value": "0b5eb26e0882a576ace88fdca9ca69a266251fea2663f2972dce0830c492235058e59f62d74ba3c64c32582e8195ea9e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945180, "uuid": "50b889aa-3097-4319-86fb-3f791fc046d2", "value": "AAF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945180, "uuid": "bb90a46e-89ed-49b1-b84c-393fb75079a4", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945180, "uuid": "ba4a8218-e6fd-4580-b5f1-2f3342ac7afa", "value": "3072:ewZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:ewZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618945180, "uuid": "5e73d63a-cc40-4598-8e2f-7fd35d16355f", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618945180, "uuid": "65359d63-6ec7-4026-a273-cecf2d2020f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945180, "uuid": "79578e1c-057c-4caa-9cbf-20a7c4ecdfad", "value": "175d914ca6f89feed0a28862c3fbdc3a9c679e9837cac2d20205a7c3bce025d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c50492-a207-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618943847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943847, "uuid": "aa503db7-5ad0-405f-85c2-8219c111784e", "comment": "Malware payload (Dridex)", "value": "7431f6edd886cc982b8a973862d28955", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943847, "uuid": "6e9b7b83-e430-439f-a1b9-8eb861510396", "comment": "Malware payload (Dridex)", "value": "178a7921c3db552dc4bbf63e6a4fbd87b349e044e32b780497802ed0a93e1fa7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943847, "uuid": "472822f6-1708-47c7-9381-46685f8763d0", "comment": "Malware payload (Dridex)", "value": "e2c6573eb33bc7605312c9f25b260e32abcf86d4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943847, "uuid": "e4b82730-fbfc-49cd-ab2c-adda7faea017", "comment": "Malware payload (Dridex)", "value": "9a37ed1de0429a2e7896498ebc4c150325f99569a8e61c4563dcb610fd1f12b6d7d5e4bbdc9218df9f400fa55aba8838", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943847, "uuid": "e41cffdb-65ab-48f7-91f6-3211496e0065", "value": "96F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943847, "uuid": "75c2b877-c691-44d6-9d69-0912f9313383", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943847, "uuid": "24c04ac5-ca39-4bad-8ed5-593263249e6c", "value": "3072:8wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:8wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618943847, "uuid": "4b8bd179-45a7-450a-a621-23cac0b00e4a", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618943847, "uuid": "4ff33846-b083-4b90-a4f0-489621dbbd91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943847, "uuid": "219dec50-0dde-4dca-a9f1-d31089cabe35", "value": "178a7921c3db552dc4bbf63e6a4fbd87b349e044e32b780497802ed0a93e1fa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f36b9f-a21b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618952655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952655, "uuid": "5e385f14-9316-4f76-b7f6-50b7dce00911", "comment": "Malware payload (Dridex)", "value": "8a71227afabd1c97c78c9120f8f65cd6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952655, "uuid": "7f98d3a4-b8ce-4231-b0c4-92c1fb8abc61", "comment": "Malware payload (Dridex)", "value": "17c977b9014f08c85743dda4d9e4ed6f7e182f190638563f89953475c7bb8a9f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952655, "uuid": "126a7693-ae96-4b4b-aa93-e49b8ec27b7c", "comment": "Malware payload (Dridex)", "value": "0f5ca78c56910d0a206e0a46f8a47ba0edb0f78e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952655, "uuid": "de5a7928-59ca-45ab-b3f1-941215da0551", "comment": "Malware payload (Dridex)", "value": "883b5c685dba0ddb6bf86f8b5dfe6177448063f346e30f35e4730c0caf698d586d653a05196e4d878ca955cfea1b6bff", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952655, "uuid": "72e115c9-8395-4e61-8d90-3c19435a393f", "value": "02F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952655, "uuid": "a0070c3e-cc65-4ee8-9350-415498bd23dd", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952655, "uuid": "44541f67-118a-43e5-af79-568a9fdf2eb5", "value": "3072:CwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:CwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618952655, "uuid": "064ef2c5-c1b6-4b49-b262-6e60b98888bb", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618952655, "uuid": "16af0972-36a2-402a-8924-91c8db491eb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952655, "uuid": "8ecee0e4-477d-4761-93fd-8fc730bc0551", "value": "17c977b9014f08c85743dda4d9e4ed6f7e182f190638563f89953475c7bb8a9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc1c6c7-a1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618899568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618899568, "uuid": "314f5e9e-baf7-48a5-b791-30ac111d2939", "comment": "Malware payload (Formbook)", "value": "c8979a538ad34c66e8ccfb7fe5239e4f", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618899568, "uuid": "f626f252-318b-42b8-8f63-f8dec2c31694", "comment": "Malware payload (Formbook)", "value": "17df69c1e0d9a5228e6583dea7a5659faa82b3a55f32c4338d80954b8e77d3bf", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618899568, "uuid": "129a8d77-8913-4c6e-b85c-c9ccec9fbb73", "comment": "Malware payload (Formbook)", "value": "eae855369bbef599ff9780b57c285331b7a4a46b", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618899568, "uuid": "163da2bd-a5f2-4e67-91cb-62d544afc56f", "comment": "Malware payload (Formbook)", "value": "766f0314ce57ce09dba7861cfc54bae8051732205966d922814f32406e052a259f841d6a6464dd9df8a71528e9bfe8ed", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618899568, "uuid": "1c904a29-367d-434a-acee-cecce09bb7c0", "value": "7AD423BBC419F1F349D40542BFF3C1642EB8E79E496ADF513031558E7A6922090FECA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618899568, "uuid": "3c91d8b6-ebf0-4e6d-8a2d-d7f49c4d6723", "value": "12288:fU5aDEFTytu4RvHptRyTlqM7iCDOT6npbyM6B2HDLpWHu1Q:BEpytuS7sTlvDLnpbyTAB4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618899568, "uuid": "1d9e746a-b1ce-4b86-a326-f9aee9ebed22", "value": 647210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618899568, "uuid": "3531bd24-d567-4e43-9775-8c4833e5f9da", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618899568, "uuid": "58345787-5cb5-4cf7-a8db-dc392a1f912a", "value": "9046- PA118- SUPPLY & INSTALLATION OF EQUIPMENTS OILFIELD EQUIPMENTS & SUPPLY - REQUEST FOR QUOTATION.pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5090deb9-a212-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948510, "uuid": "739f5c3e-6fbf-4e13-ae2f-dfa061888081", "comment": "Malware payload (Dridex)", "value": "b8813e0e721b4d8277c10af61a668cc0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948510, "uuid": "c0a3f7be-b6b5-4378-8b9a-3235c9d90593", "comment": "Malware payload (Dridex)", "value": "182db3db4a0b361ca4edaeec6831e2ff42c9bb9ee2d6a913b9765902033b19c4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948510, "uuid": "b719432e-16c1-496c-9834-e16b505206ac", "comment": "Malware payload (Dridex)", "value": "2dd83c94675875ffc22f8c06d124f8993c221c01", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948510, "uuid": "acd48536-a499-47dc-b46e-0bfab316212a", "comment": "Malware payload (Dridex)", "value": "4e4e8310cd04cdd23ede6cc9ae80fc82bcb400b4a5b3f2bbdaa02e853717f9bc12d9a88dc9fb7b6fd075743d143acd98", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948510, "uuid": "de5edb9b-1f07-470c-bc0c-756a53645745", "value": "3BF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948510, "uuid": "977abe73-fb84-4be9-ac7c-25787d00c98d", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948510, "uuid": "42035adf-155b-4014-8411-77e93c53cc1e", "value": "3072:EwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:EwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948510, "uuid": "e5f5b73a-3b6c-4c05-8ac1-4a5dc7911aa1", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948510, "uuid": "21475b45-cca7-4c3e-b435-0f590ce7d6fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948510, "uuid": "087ac422-d17d-46a3-b336-8b289db7fa0d", "value": "182db3db4a0b361ca4edaeec6831e2ff42c9bb9ee2d6a913b9765902033b19c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd96c58-a1d0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618920454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920454, "uuid": "dc24fa0f-8325-442f-b48e-b1c56c19c937", "comment": "Malware payload (Formbook)", "value": "2dde37e2961514ac44ff69b192de2421", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920454, "uuid": "a608e2f0-8959-40c3-8ef5-b089ab613a2a", "comment": "Malware payload (Formbook)", "value": "18609513507af97f13c81c7e733175ca027c4957f401e61d6654fc2ee7b4cf8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920454, "uuid": "a3964449-5ac0-4c7b-bfc7-d3e1a7561bdb", "comment": "Malware payload (Formbook)", "value": "d4d39a6072ffe87972d0fa3353e4c4874eab0475", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920454, "uuid": "ed4e7d7e-d756-4ff8-8589-a1b866620735", "comment": "Malware payload (Formbook)", "value": "1b4594d8cde58067a036900473946e32cf6c10777d67d3efa47570ea3b481da7902ebc8aa8788524fa8292ca54fa8a0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920454, "uuid": "3bcb3710-8fe3-41c2-99ad-b6c7f849e7cc", "value": "E035DF213FD5CE55D2BA4B7848B4925493F8FC118B2BC70AFEA135DC8E70FD86A52252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920454, "uuid": "f3bd3c9e-4452-490b-9686-c41e524e829f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920454, "uuid": "7c317f82-3a00-4073-9325-4d199047d247", "value": "24576:7RddHROBOobXqZA3RbvK/X43+3URRRRRNH:VddHE3bXq2BbS/Xk+3URRRRRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618920454, "uuid": "7e152ded-cce4-49b8-9fef-f9327968e841", "value": 1073152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618920454, "uuid": "8d9bfc79-3acf-4d87-bd92-832ee28fac2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920454, "uuid": "a92d2f3f-3650-4abf-8c96-d679a38148c8", "value": "2dde37e2961514ac44ff69b192de2421.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826369ce-a20b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618945588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945588, "uuid": "dd20abf0-2b08-48a4-b55e-ce85199f5e23", "comment": "Malware payload (Dridex)", "value": "9fb70756e6dc0ba2b93b1b30ac70be69", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945588, "uuid": "ae23ef1b-a02d-465c-9903-8a5929592ded", "comment": "Malware payload (Dridex)", "value": "188d9c5deafd8af1baa14a85906d031e5ca99398b90e637481339e920505547a", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945588, "uuid": "65726764-2e66-4c37-b4a4-9975d879acd6", "comment": "Malware payload (Dridex)", "value": "0a9fb56d83e3a5a5255b7a14319a477f31bcf2c8", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945588, "uuid": "41b95b26-f1ad-4b67-82d8-7faa2a5a0259", "comment": "Malware payload (Dridex)", "value": "f537a195803447e94fedb4f859f3c081dfc5b9916ee0292b871479af6e65624b1574b9e8214c66644559068c019bf46c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945588, "uuid": "6a265497-4f56-4d18-aca8-df1470de0814", "value": "A6F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945588, "uuid": "b746e8f8-6812-4695-ae56-dd173daf81ec", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945588, "uuid": "ae355018-ac1f-48ae-b6ec-5487f7f8d62a", "value": "3072:KWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:K42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618945588, "uuid": "40aaa760-1466-403f-bf52-d4e2949cba2e", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618945588, "uuid": "09bcf6f3-bfd1-408d-865e-47b58563def8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945588, "uuid": "e82cb491-b7fe-4c62-b0d5-16a490e25464", "value": "188d9c5deafd8af1baa14a85906d031e5ca99398b90e637481339e920505547a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93986ca-a198-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618896314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618896314, "uuid": "7a9eba2d-6bae-4674-b79b-93dec8b4b2ce", "comment": "Malware payload (AgentTesla)", "value": "793330f1be7b537fcd93db700ff9d61b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618896314, "uuid": "ec2a1b4f-a873-44a9-be3e-3882030ac0f0", "comment": "Malware payload (AgentTesla)", "value": "18914325535114aeede19d5b10bbfff53234570c1f18582e9fb194891f0a9315", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618896314, "uuid": "6cf3f3be-85ba-49eb-af3e-82feb266a23a", "comment": "Malware payload (AgentTesla)", "value": "78a205f732e8306fd1fd647265375bd51ed94ba5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618896314, "uuid": "d03fad83-f584-4a48-8a80-b5b59066321b", "comment": "Malware payload (AgentTesla)", "value": "451ee79b075d3571f21716324b9a50b3e61b7d290b3281ad93c9e42e674b51373ed391b31920d02ac51fd3103b8f1a7a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618896314, "uuid": "f269e92e-7a21-45a5-afdd-f4b90f787fed", "value": "B90502256A9CFB49C87D1BB1E870487113B36253E363DA5FE84D01894EE1782F86D36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618896314, "uuid": "1f215e43-4428-4eae-a9d9-6ca7b8ad44a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618896314, "uuid": "72e50c94-e5a0-42e1-9fb1-5e8f298e7997", "value": "24576:chSur0m6yuQx+5EmI+WP/dLukSea4WAvjbbi:SSo6wxB4WP/dSBerWAve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618896314, "uuid": "ac6eb407-f0d8-4af5-8581-5bb91f16865f", "value": 836608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618896314, "uuid": "ad2c8b4c-bcbd-4d81-a4ed-e72c6e8d135d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618896314, "uuid": "0c5eb7df-6ecf-4b3d-b849-5db6c65c454c", "value": "Consignment documents.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9378b94-a205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618943183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943183, "uuid": "6ca9f0c7-0616-4254-a542-f76f94c7c2b2", "comment": "Malware payload (Dridex)", "value": "ca74ae1526024fda1fa765bf232c0afa", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943183, "uuid": "0bac2f1b-55ba-4158-a5d9-632bd196ef3a", "comment": "Malware payload (Dridex)", "value": "18abf5e3fb4e35c300fa93b40fd2b5d560fe69caef6835a924a4dd95d9bbb269", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943183, "uuid": "265195ad-2316-4f48-8796-5ed1fa37e4f5", "comment": "Malware payload (Dridex)", "value": "beec78180cc0ac36b6c5cae2f9adc71739dda058", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943183, "uuid": "bf75b52a-bca0-4215-bcc3-9d2fe3a1c23a", "comment": "Malware payload (Dridex)", "value": "3b5b9d955cd609bc9d192143189c38300dbe148a68a636f958e06f20b92fa870695bc66f59687c88b520b094469195ca", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943183, "uuid": "d09be844-6ea6-411d-bc02-abb1fd1f27cd", "value": "44F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943183, "uuid": "7ff1ec9f-b0ad-40a1-bc31-62415bc9fd96", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943183, "uuid": "2b6d56de-1d37-4fe4-a72f-c260c26536de", "value": "3072:EwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:EwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618943183, "uuid": "e7b0e813-ac9c-4753-87e3-ef33a66b6ff5", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618943183, "uuid": "6eabd957-7ade-4e72-9805-8413ebcdb0af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943183, "uuid": "b1aa3bf6-f661-4981-9b77-e2c77d32ffd7", "value": "18abf5e3fb4e35c300fa93b40fd2b5d560fe69caef6835a924a4dd95d9bbb269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dbcaeb2-a21f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618954116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954116, "uuid": "38cfe748-6120-44fc-853d-cb823d33c2a1", "comment": "Malware payload (Dridex)", "value": "b104941950708a723d27a7ff66df68b7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954116, "uuid": "f9d47243-984c-46fd-a823-28e268cde403", "comment": "Malware payload (Dridex)", "value": "18b86d95b6e9c604d836751af1c5d2dade33e42ec6e214f9632cafa83eeb8a1d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954116, "uuid": "72b2a754-c5fe-45d5-ae94-ff4f57e7f964", "comment": "Malware payload (Dridex)", "value": "126243711ea676092a7a9656b8f477fcf913f43d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954116, "uuid": "1db59df6-b094-4a8f-b46b-5a26e237428b", "comment": "Malware payload (Dridex)", "value": "05a8a96c964fc6113244e0142732d7a84c116fd5b508a6e91f0c216820fee2054fd3e09a8698518644e56562fe727c9f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954116, "uuid": "8b3406d2-bbd6-44c6-a00c-e18e20637b19", "value": "BCF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954116, "uuid": "cbcf7f23-2cb3-40b3-b6a2-bdd7e5dba6a7", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954116, "uuid": "ba14f3c1-57e7-43be-b2f6-298e9e729a3a", "value": "3072:IwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:IwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618954116, "uuid": "03d837ad-5914-480b-8189-37847d4b8b67", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618954116, "uuid": "f7474244-39f3-4fb5-b61d-5269320d2af5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954116, "uuid": "ee2e1972-2b8c-406e-9d47-f3a9187464be", "value": "18b86d95b6e9c604d836751af1c5d2dade33e42ec6e214f9632cafa83eeb8a1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dae50b5-a19d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618898174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898174, "uuid": "5ab7d9fd-6270-4a5a-8f97-85ab7da22ed2", "comment": "Malware payload (AgentTesla)", "value": "5e52d546bf55e00b16eeba9e00adff81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898174, "uuid": "7fe4c4c8-8869-43ab-92d0-20faed6eda58", "comment": "Malware payload (AgentTesla)", "value": "192f1700dfb08c74e6659dc411262bd2f69b69ee72a6d1fc0d68d4b485ee95ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898174, "uuid": "2f1a972d-19b7-453e-a96a-0fe574d9e457", "comment": "Malware payload (AgentTesla)", "value": "2859628f7b8c99e5abcb21c7c62a1aad0fce628a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898174, "uuid": "9b26e32d-c3ba-4dd4-81a3-4b5ed0e1ef49", "comment": "Malware payload (AgentTesla)", "value": "19f80019ef5ab4bf991f9b1ca7b597be1c138220bf9fbd4e59d2fd24b67aeec9ffbccf31ed22ced58323fb56ea963be3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898174, "uuid": "cc179b77-4bb3-4504-bd51-ff6664716371", "value": "6E155B5C721075DEDA9BD2768BA85C64EB503C77434B420BE06335BAA97CC83DF160BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898174, "uuid": "13ba9be6-e063-47e0-b858-f098f304daa1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898174, "uuid": "2dc2deb9-81e0-4dbf-8c07-810c6e030d64", "value": "24576:qZ7C1xwOqwRzKIQ9JHz7+DE6yJRRRRRGa7eSfx:E7B10zZMJ3+pyJRRRRRGmeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618898174, "uuid": "2ac2400f-75f7-4bc0-b8c4-a872e75b6968", "value": 939008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618898174, "uuid": "289f8d72-19d9-4575-b027-06c9f1481c7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898174, "uuid": "f8e46748-fd53-416f-8ef3-e8f6f43b9667", "value": "PAYMENT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20451a6c-a1f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1618934256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618934256, "uuid": "945235ea-c4f3-4d45-8848-9197dbce5260", "comment": "Malware payload (Mirai)", "value": "dac6abe0c96c2655f58f5ca4fc139ea8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618934256, "uuid": "63da3a1e-67e5-4064-9304-2ba88cbc4a0a", "comment": "Malware payload (Mirai)", "value": "1947ab53faace7d095341791cd2583bcef5419c09b6de6b9052277a3b77e0a14", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618934256, "uuid": "ec6c33dd-4ea2-4f4f-bf7e-a65bc4e58b07", "comment": "Malware payload (Mirai)", "value": "33d9c6a342c94c6d4b4c8b615c7dc7857e1a02a7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618934256, "uuid": "48b15604-c698-4cda-91e4-ec2dfa3f41b8", "comment": "Malware payload (Mirai)", "value": "069c94db170af9630554d4c8dbbd4c5981b6975025e6716e6ef92c725ce75a50552599ee3bee80639bddd206e52e5fcc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618934256, "uuid": "05de7784-45cd-4577-aac3-816610c353b4", "value": "AB13F1E46C4A04F217708431E8AE12E0A5F70676D2F6703629C6F36CEA6640EE5F12CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618934256, "uuid": "b8457282-20ec-4bb9-af37-6ad1f7b17cb2", "value": "768:3vDkWJSym1afrVRl+1U4hYMa3PHIrGudW6o1kkbL3GiGQjQ5s3UozB:3vg4Sym1af/lGlhYdPHIrGukZzj3jQEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618934256, "uuid": "70b17289-7788-4ec9-a104-1cf78b80ecc2", "value": 41468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618934256, "uuid": "35690eff-f2d4-4247-9c86-55418a8d193a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618934256, "uuid": "7401e27c-94df-4adb-a5df-eab43f8a45c1", "value": "SecuriteInfo.com.Linux.Mirai.4306.11596.505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7390b498-a1c8-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1618916786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916786, "uuid": "bd98da5e-eb9c-4e3e-9ae5-9a0625e5f498", "comment": "Malware payload (NanoCore)", "value": "cf764673425b6268f1a417a2c1cc616a", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916786, "uuid": "97308849-678c-4357-a19f-afff00331916", "comment": "Malware payload (NanoCore)", "value": "1994d0c611df8b0fda8bc8918eecad88f19f676a561bf00f49fcc8272f8011d9", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916786, "uuid": "eb9d5e6e-bb9b-459b-846a-dc932cc62400", "comment": "Malware payload (NanoCore)", "value": "b8a998ba02294918d89c2c21ceb525200d6f0459", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916786, "uuid": "feec30f9-f00a-4ef9-8af2-73805194e25a", "comment": "Malware payload (NanoCore)", "value": "cee94f6af9d9d87f3a14358c6e04a708bb3fc26e1c4fbedf656d8482ed835fbc040426a37388a067c6ff115af9296005", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916786, "uuid": "6ebc86c6-7c82-4a81-a8b5-6373872f0ffd", "value": "7AC53315DCD35B13D1AD72F2E62BE028006A1D55B612A85B73BEB36270767B303E2B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916786, "uuid": "c24c1613-1e64-4b6b-bf3f-c8f8602862a6", "value": "49152:8pL7oBJaq/aU+1zacbod65W0GMCpVMUO+f5BrXLY9exuray6tA+S5vK5aRXk26a:897oHr/Y1bQ9M+y7MM83ttI9k2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618916786, "uuid": "a58f3308-d602-4269-ae9e-8f1c6e3fefa2", "value": 2717696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618916786, "uuid": "3ceaf994-a7d8-41e8-a1ba-4a824287f5a3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916786, "uuid": "fbfe3fd1-83d9-4c50-b7bc-b186b0ef28b6", "value": "RFQ180584.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07a8fb4-a20b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618945745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945745, "uuid": "9ccf9007-b8ae-49f9-bf07-f54644fef9a8", "comment": "Malware payload (Dridex)", "value": "bfaf82784a50aeb472206c7be1bf9e28", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945745, "uuid": "9fccd2d8-2d1b-4537-a39e-9b2cd24d6489", "comment": "Malware payload (Dridex)", "value": "1a059f2b320cb5a06da6efda8af3727e8f9c5cc4869df56f211f09c2d4d216b7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945745, "uuid": "d07be3df-1832-4e6a-8fa5-62e68acd8298", "comment": "Malware payload (Dridex)", "value": "dc7397ea90119c90a2a94889e6b0298a8700a62a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945745, "uuid": "ac468ce1-403e-4704-86bb-ac41534306ed", "comment": "Malware payload (Dridex)", "value": "adfa024d991076216c95041efff72d6ee5bbdaaa19e80c640ddb3b96d9adc3dc9071d0ef10d64ac2b5adb0c05fe24e21", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945745, "uuid": "2612e311-8aa2-422f-b155-7a95c3aec0be", "value": "42F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945745, "uuid": "d8b82c4a-311e-453a-8b39-db86b21e390b", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945745, "uuid": "9b3a1fcc-7fa8-41ab-b690-10a7a0841cd2", "value": "3072:rwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:rwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618945745, "uuid": "cb04fb8a-8296-4dfe-80de-913c1044fc74", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618945745, "uuid": "f1e81838-2d2c-4601-b7e5-5c5d6ca47d9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945745, "uuid": "bae25d92-bea1-49d5-9770-0c9f2a074bf5", "value": "1a059f2b320cb5a06da6efda8af3727e8f9c5cc4869df56f211f09c2d4d216b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8faa30b-a215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618950055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950055, "uuid": "9f10489e-4757-463b-ba2e-2b3ad5b9c07f", "comment": "Malware payload (Dridex)", "value": "9f4d7f767fe6dbc0e65c8cbabf6d34ef", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950055, "uuid": "e035fc83-0d87-41f4-8c02-bb01983f0ae6", "comment": "Malware payload (Dridex)", "value": "1a60337aa3ad02d6d2c5c092c716448d74ea4e62bebabd70b994a3fea57e2c7d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950055, "uuid": "1b7b0e55-c542-49d8-995d-301a22ac8f8a", "comment": "Malware payload (Dridex)", "value": "6eef1ac1d8af90a2abfa68b39f15e9b63cc24098", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950055, "uuid": "fd1f8765-5a63-41f6-9ea6-9b1d46a2c8c5", "comment": "Malware payload (Dridex)", "value": "431bb9a69bac7a797c9f19e7a8795711e4ee4a283e5d3827fb57b58be7b9ad733c7ba738eb36aaaf45c40add2d5bf109", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950055, "uuid": "57bd4da3-166e-4d96-8e46-fb66e1d31f74", "value": "1AF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950055, "uuid": "352e8dd3-32a3-4a7e-a096-ae089ca43c35", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950055, "uuid": "2d2deebe-b2d8-4609-9df3-05c0a1955d44", "value": "3072:bwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:bwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618950055, "uuid": "50229e2f-f625-4174-bd07-0a5326868ee1", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618950055, "uuid": "0df7e90e-e0d7-45f3-bd59-a95b1117053f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950055, "uuid": "29d966f7-72ac-4531-bd8f-6cd09d2efa28", "value": "1a60337aa3ad02d6d2c5c092c716448d74ea4e62bebabd70b994a3fea57e2c7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39573da-a1d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618924195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924195, "uuid": "9b8ed437-fd56-4756-b51d-1fcb01ba2a22", "comment": "Malware payload (Dridex)", "value": "2cfd512c66e023cf69d8193fb860e8e9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924195, "uuid": "8bb25717-018e-450c-babe-67f0145087a2", "comment": "Malware payload (Dridex)", "value": "1aae3d54773e5526d8c118c543ed98c95c970159bb8c82bc27f8194850592de9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924195, "uuid": "6caea31e-852f-44e1-b579-f050d886787a", "comment": "Malware payload (Dridex)", "value": "fc22040538373bb870419861390d94fe793d6a26", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924195, "uuid": "1383488b-4604-4a24-9957-cf2311c7e54b", "comment": "Malware payload (Dridex)", "value": "26a2777f9afdd72c849f73fa79a16f26b1fd7e68fcff1b08e39ebeea65f479eb607fe0dfa2059853fe396ac64708093b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924195, "uuid": "ae09dd63-f344-45e4-9dbe-c7dbceeb4d23", "value": "9EF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924195, "uuid": "cf19a5bb-9469-4114-ae80-dbe809ed374b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924195, "uuid": "e02ae556-597c-4332-bb03-ddeef8a61478", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618924195, "uuid": "bc5f2cd9-e898-4c2c-a194-328d12db19cd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618924195, "uuid": "3d0d125e-65b8-473a-8d93-1b89e0ce3f0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924195, "uuid": "cbaf56b1-8d74-4fe4-9380-71d524868add", "value": "1aae3d54773e5526d8c118c543ed98c95c970159bb8c82bc27f8194850592de9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037e4b2a-a225-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618956542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956542, "uuid": "6f0ce731-c07c-4a4a-b4be-0a717c819687", "comment": "Malware payload (Dridex)", "value": "755ae2e40a6bf552e4458baa963b3d4e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956542, "uuid": "3167f456-592e-46db-aefa-10a86f08c3aa", "comment": "Malware payload (Dridex)", "value": "1ac9707b7d0b8dd574b0c60eaf691a4eb880a64040ddd1cb571d7e4cc971471a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956542, "uuid": "220cbbbb-7fb3-40a9-a3ea-896a77563696", "comment": "Malware payload (Dridex)", "value": "6fd00c81d8be0308721143da19b811ac537dbb62", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956542, "uuid": "153c5c3f-618a-465f-b311-c41ec3dcd38a", "comment": "Malware payload (Dridex)", "value": "f931b105e0197523428924b7d5f963bf60e9ad9dca2f8039b529a6346d50af00a5e73fffac21e933c2f70d125bea6236", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956542, "uuid": "ee0a0854-173c-43b2-915f-ab9f58f9d798", "value": "AAF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956542, "uuid": "1e006b61-5612-4420-9992-12615273f37a", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956542, "uuid": "55cbaaa0-f3b4-4acb-8346-9af1b9d20c4f", "value": "3072:hwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:hwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618956542, "uuid": "3a58e244-7c1e-4bc4-b4e2-4475a843bc49", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618956542, "uuid": "69e67853-4c82-42af-9069-76234ab07c64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956542, "uuid": "25ed9ac4-afe7-440d-b48b-54dd0de9fe06", "value": "1ac9707b7d0b8dd574b0c60eaf691a4eb880a64040ddd1cb571d7e4cc971471a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db6bf11-a18a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618890040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618890040, "uuid": "4d19538a-617b-46df-8e4c-efcd0b090df6", "comment": "Malware payload (Dridex)", "value": "95fa5fc5bbe24c51f674ead63af2ef7d", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618890040, "uuid": "cc8beb4b-fb1d-49cd-9e8f-ac21becbd9ba", "comment": "Malware payload (Dridex)", "value": "1acefc430265cd4d1c30f5a2f249b2eb6e4f795aaa00a69f5b223c934ca45dde", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618890040, "uuid": "9aa881b0-80d0-4ba4-bba1-4fe01c04098d", "comment": "Malware payload (Dridex)", "value": "86d6e59d986aa4dad8f5424fa666ee210ed43e3b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618890040, "uuid": "14f1ae54-fa4b-4148-84a7-4594863c2a64", "comment": "Malware payload (Dridex)", "value": "1ffd7087831f2e243c95112f192662c7cbbef24c33589c0a9a8283650bcb8ffd3e0c5fe98166d0faa8fe20ecc3deec01", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618890040, "uuid": "25869e2b-0124-4f2c-8a6d-4367433af88f", "value": "D4F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618890040, "uuid": "b8a27bbe-e83d-4224-bf9d-1cca5217eab2", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618890040, "uuid": "42349597-7b55-4a3d-958d-b500518fbba3", "value": "3072:PiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:EeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618890040, "uuid": "556813df-b746-4c1f-a237-beeff2d18f16", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618890040, "uuid": "1a7f2bdd-3cbe-4c4f-9b5f-2c5e96b6d9e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618890040, "uuid": "e3452d33-77e1-4875-adc1-baed25cdc9e8", "value": "1acefc430265cd4d1c30f5a2f249b2eb6e4f795aaa00a69f5b223c934ca45dde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70996914-a17a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618883281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618883281, "uuid": "07002c8d-8443-438c-a3c0-5fd640fffac4", "comment": "Malware payload (Dridex)", "value": "6dd33c4a21a4c11d98a4b3c445a31169", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618883281, "uuid": "99a2cba7-1de5-4cdf-8eef-2521254e53e4", "comment": "Malware payload (Dridex)", "value": "1ae0b4942f406b8126c2b70cfadb5d1db0b8e9dfedd5bcce652b0b3715e4cac0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618883281, "uuid": "fe8e3d4c-adb5-4d09-a911-950958c3a475", "comment": "Malware payload (Dridex)", "value": "8f5d46431432e81069e9995a51f0df1d37858e8d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618883281, "uuid": "d470131a-3eeb-4c94-9066-3372bd58c16d", "comment": "Malware payload (Dridex)", "value": "50fa1f700e9b275e897614c62ce18b3be8f3b1ba798816b8c2ed596234996a620fc044f3b0106f4316a7eec4d3318df0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618883281, "uuid": "f822b4c9-57c4-445b-94ed-83460b10808b", "value": "18F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618883281, "uuid": "4a380758-4018-453e-a481-f0003e5e1a85", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618883281, "uuid": "926f2dfc-f60b-4328-844b-be309c0db634", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618883281, "uuid": "a76c55fa-d78c-497f-a3a7-5fcce077af15", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618883281, "uuid": "d8047f2d-76a4-4447-a92c-568e51ea4f12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618883281, "uuid": "6bbe153f-3995-4a74-8e80-b7c3c70dae6a", "value": "1ae0b4942f406b8126c2b70cfadb5d1db0b8e9dfedd5bcce652b0b3715e4cac0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3536eb28-a183-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618887047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618887047, "uuid": "220f1b80-735a-49bc-b689-924e50a6cdfb", "comment": "Malware payload (Dridex)", "value": "40cbc5a72c0723f27876e655a1627cf8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618887047, "uuid": "49694b71-699d-496f-8694-470787d6b952", "comment": "Malware payload (Dridex)", "value": "1b071e51cbae05b1426e0b0a03ad2a1a341209edb510690b01aa6964905af542", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618887047, "uuid": "d52cbb77-e933-435c-9408-df1bc71163c4", "comment": "Malware payload (Dridex)", "value": "4d6668edb3bf6fb911f8a5e304914c6fb71b5ceb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618887047, "uuid": "367f9fc3-f03e-4518-ab5e-0093739653f7", "comment": "Malware payload (Dridex)", "value": "1a8257aef54d143a7026217664a210ca6ec7bbe70dc6d2e1467cd220e8cd6de07c791b0eba61e7b1e39974b5d1504cfe", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618887047, "uuid": "c782378a-ff56-4050-818b-bb20da9f6350", "value": "F7F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618887047, "uuid": "c797216f-4400-4bd2-a9cd-a0500b432eee", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618887047, "uuid": "fa5cc817-838d-4e95-9246-715a9815d72b", "value": "3072:RA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:R3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618887047, "uuid": "cdb11887-4294-46d6-816a-c58d86b76c43", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618887047, "uuid": "aa3c618d-fcf2-439d-94d0-246f9e0d4c60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618887047, "uuid": "77db9662-53ab-4ce2-a2d9-50b5a062ab7d", "value": "1b071e51cbae05b1426e0b0a03ad2a1a341209edb510690b01aa6964905af542", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b4af78-a19e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618898560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898560, "uuid": "53cdc12d-314d-4944-9b1f-256e94a7e246", "comment": "Malware payload", "value": "109c82fb9e5cf0926cc07acc3c34563e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898560, "uuid": "a049e994-f94b-4240-bb2d-014ecea5ccca", "comment": "Malware payload", "value": "1b2155f2df693ef4f05ea92b20c266af854259620755205ee965fcb1382eb1dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898560, "uuid": "76af3281-6587-4134-a5b9-7402b350fe10", "comment": "Malware payload", "value": "0c6083965310765a0c317028b9ad062659f72089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898560, "uuid": "3f519d7b-8071-4feb-a439-f4f375eb7d13", "comment": "Malware payload", "value": "8c9d3e7f5fa7fff64264f5af809ec43b53444f601be1e0d8d19897456671d3f936419d0caff9a6a583ee16ae3277762a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898560, "uuid": "0e23b31e-0f4a-4221-b743-4c3ab7776f1e", "value": "1A03A56B20607159DAD309742D66FD743B24AB709C84E10EE462964CCF82BFE74EC9DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898560, "uuid": "85112acb-0147-4d20-9827-c948400f478d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898560, "uuid": "27a2e5d5-4464-4c63-b49d-9938dfc6610d", "value": "384:OcpcbGovlSPgtHzMjZvYfi/aTWQe+OIUiEoBWNIDKF/uGqoRx0gbOqBhf5lq+zxd:dqGoBsZvYEQu1NVuwvOqB1zPE9FhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618898560, "uuid": "e1a1d5f7-cf79-459c-88dd-8d47435595a8", "value": 39552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618898560, "uuid": "5c768771-b58d-4bd0-bd77-0d29c85529b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898560, "uuid": "b7afa50c-2211-410d-b97b-a23ae82ca190", "value": "URGENT_QUOTATION_PR # 270473. 20-04-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a19392-a1cd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618918998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918998, "uuid": "cf5b0835-bede-4a11-85d9-8253fda58aaa", "comment": "Malware payload (Dridex)", "value": "5d8be7fd72ef330e7a2af4c5f3b43688", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918998, "uuid": "67102c43-ffa7-488f-bfc2-a7c904ba2347", "comment": "Malware payload (Dridex)", "value": "1b4bd2043381be23852c2696f589e60fdaced1558b876cae05853956dd054691", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918998, "uuid": "3b0643c9-3b21-435b-9f24-bbde4b9ada5f", "comment": "Malware payload (Dridex)", "value": "d72cd01738888d731cb07cc8fba014bb5937e2a1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918998, "uuid": "ed4af496-6a16-486d-afb7-54a421850044", "comment": "Malware payload (Dridex)", "value": "57ac653a2a55ab10a7869f055c91cd6dce51d46884766a7a1e2dde1bd1696cdf3ae981388aff4361ef20de139e506bd0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918998, "uuid": "b8e0fb18-f8d8-4e92-bf62-3f9b16bfdb35", "value": "EDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918998, "uuid": "66d1c1db-84cf-4710-9964-b6e6ba337fa3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918998, "uuid": "4fce149f-2dba-4298-9ac3-c0df5d9e1cfd", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618918998, "uuid": "50452a11-fefb-4001-874d-6225a0e990ab", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618918998, "uuid": "209bcd23-038d-4c78-861f-b2e968efceb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918998, "uuid": "81041ea8-71a8-4014-bb37-89987fd42ce5", "value": "1b4bd2043381be23852c2696f589e60fdaced1558b876cae05853956dd054691", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5353d948-a22c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618959682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959682, "uuid": "aeedd6f0-a982-4965-a48e-a08710ae09de", "comment": "Malware payload", "value": "0fa9dee5c2a1c7d707f65315f44e9066", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959682, "uuid": "f1fd6fce-352e-4596-9a7f-c792f2878b88", "comment": "Malware payload", "value": "1b50a8445a6281f979f940983a0d44000b8d8115e3fca15f1f6b52541d20ddd4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959682, "uuid": "b63cfd3a-0ac6-4842-b5de-80d87291f248", "comment": "Malware payload", "value": "2daef212ff45fc42209799eea6544a2c17a14f05", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959682, "uuid": "703b1f71-38ee-4130-80d6-f1f4945bcb73", "comment": "Malware payload", "value": "d4f77f8ca7a1d48aff8322fa135592fbba5b36a873f624c460cbca7fedf7b73f0a84311091ee4d441b386ee298df3f3e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959682, "uuid": "78f31edc-31fe-49fc-8509-7e935d14a819", "value": "E7F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959682, "uuid": "8ba5d62e-99df-45d7-a5fb-ad5d1f34875f", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959682, "uuid": "b30c9214-82ca-4b26-b2d5-dd059eab0322", "value": "3072:owZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:owZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618959682, "uuid": "d5f7e878-cbc7-405b-b8f5-1df6688dc351", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618959682, "uuid": "2fc4136d-5cfd-4ca1-81f3-7bcc3cb4eb3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959682, "uuid": "a52410e8-51c4-4286-bb04-61c0a169c8ae", "value": "1b50a8445a6281f979f940983a0d44000b8d8115e3fca15f1f6b52541d20ddd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee450a4-a1eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1618931730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618931730, "uuid": "d60b385f-de78-4983-b266-1614f540b486", "comment": "Malware payload (RedLineStealer)", "value": "a76f4a775a5192ce5ba615afade9339f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618931730, "uuid": "21acfba6-8576-447f-b749-64a5524ba26e", "comment": "Malware payload (RedLineStealer)", "value": "1b5f028f56a42cdc327697175573023f64dcfcf88391e8f3dcb30281d80648e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618931730, "uuid": "0151a450-6835-47f6-a0b5-9de6080aff08", "comment": "Malware payload (RedLineStealer)", "value": "14ebd7ebf30f79b0e0381e5505f0cb831b225e38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618931730, "uuid": "fd499431-e104-4ab8-81ad-5a97985ce078", "comment": "Malware payload (RedLineStealer)", "value": "a8c134e94be915f97ff7d9c2ff80ced8787010c82e2ef14994f4b34c623e8bb75b34d9de5e36cc5703ce4e3c87092ed8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618931730, "uuid": "509b67d7-4f0b-4929-b6e9-c6342ad28f67", "value": "0B12F724A784D375CCBB1A31ECB323408670E7900467DA9F578D89176DF3F289AA26F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618931730, "uuid": "4a67dbd3-4b05-4bd3-8da2-2f19730831e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618931730, "uuid": "8705cb44-e932-497f-ad3e-36497872cbd5", "value": "192:wBksuz9MuIoWeMZZ3I93Vnjdwqzy3auhqP:llpWeMEFnhwquKuhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618931730, "uuid": "99d8c460-11f5-424d-8d4c-c9b2994f49ae", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618931730, "uuid": "a6bca8ce-ba7c-4a76-b40a-719f2133804c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618931730, "uuid": "e5ad5fca-50aa-4aa7-92da-e10bb6829214", "value": "a76f4a775a5192ce5ba615afade9339f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e784ae44-a1ce-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1618919558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919558, "uuid": "64eacb8f-7aa4-4958-b735-b0ebe5f5bc28", "comment": "Malware payload (RedLineStealer)", "value": "738d5a4f04a3f8736d7dd7114d7e6d7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919558, "uuid": "a743566b-47b8-495b-ab96-b5bad3b4a18f", "comment": "Malware payload (RedLineStealer)", "value": "1b7e71a2f442c189450c25eb26d831ef223162c14f3cb5612e4424863e05b6d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919558, "uuid": "203fa030-85ea-457c-a05f-50dad9f46b72", "comment": "Malware payload (RedLineStealer)", "value": "b7c7115f96acbf86e5a4ce507a4b188dacec064a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919558, "uuid": "a3ed9308-d9b0-4c08-8099-3f15f50cdc22", "comment": "Malware payload (RedLineStealer)", "value": "397320bf5778fc85b07a08ae13181d5911660ea24e782a7059964dc9ed332654d8691bf444eb8a3bb00944ec3b6b6fa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919558, "uuid": "a07d2d97-c961-4a3b-83d3-d4da84ba0ffb", "value": "04D35D39736DDA25E6BD4E746470212643F1E1CB2021EBDB8ED1ACDA2E2678177046F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919558, "uuid": "abdb2f61-0e14-4238-a55f-1d082eb18ea4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919558, "uuid": "884b79bd-e9cc-4421-bf53-77750247779f", "value": "1536:NbFrZPEsPfivfgWYV/pr2E2xN6jG7pZUoFKpnZStVfnIp93V7Eb3ArH+SoHJbRyc:S7v+A7KstVg3VQWHyHJtyddzzCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618919558, "uuid": "a416cfb0-7b76-40fc-aea3-c7f2d5c61c69", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618919558, "uuid": "8aaf63ac-38e2-40a6-b535-c7947455af0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919558, "uuid": "98b17a62-0040-4033-9422-1497e914691b", "value": "738d5a4f04a3f8736d7dd7114d7e6d7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b619c7a1-a1fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618940091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940091, "uuid": "013f02f0-2c1d-4f8d-9a6a-380d40b61f92", "comment": "Malware payload (Dridex)", "value": "a8ef3feb9e79c05c21c3a180e76ce80e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940091, "uuid": "d0133664-efa5-4db6-9397-b304560d4f46", "comment": "Malware payload (Dridex)", "value": "1bf428611cf950458d2775c8a8c86efc2574f1a0643c998235b5840ac4f39736", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940091, "uuid": "798cf75b-24cd-418d-97d4-be158388aa81", "comment": "Malware payload (Dridex)", "value": "cd4d0e7d4b5e153f25d88fc6fc5e9feb3b70efd5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940091, "uuid": "201edf9d-06b9-4048-aeed-7ccf288d50f5", "comment": "Malware payload (Dridex)", "value": "3dc210b2fe96a2c7c0a8a8c86d7ddab04903ccfc27e461b14650dcfcd0086700d8fa3a9e79249961590554f45d956900", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940091, "uuid": "3815c5c4-fb81-493f-bbb9-2a7c254e56cb", "value": "DFF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940091, "uuid": "1e6bd7f7-aa07-4251-a943-78bbed091f4a", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940091, "uuid": "815cfb68-6ed5-41e5-a638-1cb1bad20a1e", "value": "3072:DwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:DwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618940091, "uuid": "d7b9199f-eb7a-4616-b6c3-11178ad94dd6", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618940091, "uuid": "c67ea47c-80fc-4451-90d3-5d86cff20ad2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940091, "uuid": "7d1c8f82-d37d-4466-8c11-52669c1157e8", "value": "1bf428611cf950458d2775c8a8c86efc2574f1a0643c998235b5840ac4f39736", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5edf6ad5-a212-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618948534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948534, "uuid": "f83318af-e482-4683-89c9-c70fa9db8155", "comment": "Malware payload", "value": "5b8b68414a874239e77877c70df474bd", "object_relation": "md5", "Tag": [ { "name": "PW:2252563", "colour": "#01C50F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948534, "uuid": "28ce596a-aebd-49a7-9cd0-1530ea7fcb92", "comment": "Malware payload", "value": "1c0b7c3f7944447855439790914ad57ec04ae02376643b5fcfd9da3d23ecc697", "object_relation": "sha256", "Tag": [ { "name": "PW:2252563", "colour": "#01C50F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948534, "uuid": "013a6b17-2614-4170-b4f6-12210a7c91c4", "comment": "Malware payload", "value": "85bd146a1c7b06bbc366f9d95742d64ec996e3c5", "object_relation": "sha1", "Tag": [ { "name": "PW:2252563", "colour": "#01C50F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948534, "uuid": "cc8837c5-bc9d-4002-8c17-cbbf6ce0b975", "comment": "Malware payload", "value": "99a59793149e661d23100da18eb9f447e01d4b74d9744190558b1b9059c8d0c837f29c8ea59799d323a768e74a8517c7", "object_relation": "sha3-384", "Tag": [ { "name": "PW:2252563", "colour": "#01C50F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948534, "uuid": "a1abc09d-7af9-4c03-b2c5-ba14bcf8d895", "value": "C5E3128B6180286E8DEA9DEC0E347DBB046C7C11D42D6DADE813731AEFD14617B539AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948534, "uuid": "4f9ba9b0-21f0-48ec-8e49-11dad4b743ce", "value": "3072:J39pnnaL7qNyFwbjRY81DZXsNuO2zTnH4SlCr0xE8lMeIsWg4jt51ASV16hqSUWO:RKLC5jG83soxTHVfledt51ASahDZFKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948534, "uuid": "6cab0200-1d00-43da-8eb8-513d6acb64b7", "value": 155497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948534, "uuid": "cd89b0a4-5fa7-4bfa-b6e6-34f0ee7fa7c0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948534, "uuid": "a883ca07-b0a8-4fc9-8d3d-0042a0a29f9c", "value": "request.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49db99cf-a18f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618892235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618892235, "uuid": "132716d5-6106-4936-8055-608a2f2fed96", "comment": "Malware payload (Dridex)", "value": "cda118ce5befa50d7b5c8d2cf9653d7d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618892235, "uuid": "f3bddae3-e9a0-49f2-92b9-e07a2c0d407c", "comment": "Malware payload (Dridex)", "value": "1c0d9fa8c565d1f7b76c87ebfa7b1ad50d164aee70d7da193a69c9e623d52356", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618892235, "uuid": "309a83da-d682-4db8-b4c6-613ea6b02a68", "comment": "Malware payload (Dridex)", "value": "be4321f67d5975ea9b5c7b29da84b7576c44d0f1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618892235, "uuid": "9bafce94-97b4-49d6-b8af-0e7607dc4b20", "comment": "Malware payload (Dridex)", "value": "16d8da67477751b326ad27c6c5ce9e54353a249f84aa142315e489d1ea64cd11c55b1737775cf6d5d6b4d4bea4d382f6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618892235, "uuid": "b284dcdb-88a9-4caf-b392-5baf63c5d22c", "value": "C7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618892235, "uuid": "13c01fa2-9142-4ee6-ba9a-363918d8302f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618892235, "uuid": "6d03f49c-bd8d-4f3d-8455-f4068ef83e2f", "value": "3072:mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618892235, "uuid": "f304b2b7-77b9-4b4d-bdcb-2be7a5168104", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618892235, "uuid": "4132fd17-6042-496c-bdc9-5d6633442011", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618892235, "uuid": "582c16a7-4c39-446c-b7c3-7fe8c994090a", "value": "1c0d9fa8c565d1f7b76c87ebfa7b1ad50d164aee70d7da193a69c9e623d52356", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda8f00d-a218-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618951378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951378, "uuid": "1a431625-53e9-43f7-a5f2-aad2e2b957f3", "comment": "Malware payload (Dridex)", "value": "56f612a779a973204df22d0e5cc8bc48", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951378, "uuid": "608b5eec-ba4d-4b48-a755-dd8a82dfbbd6", "comment": "Malware payload (Dridex)", "value": "1c3a0c58fe21c918450ead2478fbce1d1adc3eacd802353b4c930980c67ff2ed", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951378, "uuid": "b1a7d61a-807a-4fdc-bca6-32b8f443dd2f", "comment": "Malware payload (Dridex)", "value": "644a1d4908b666f88650ea4ecbdb12a719ea8676", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951378, "uuid": "6e5c5d08-9677-4378-b9ed-bcd15ac8ca69", "comment": "Malware payload (Dridex)", "value": "4a8358526c679ed310a5f22a5b8bc4dd1269ad5b0430a47a7d4c92f6858a5f7af6f14adca3dff5b26dde8da43d99cabf", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951378, "uuid": "7a3a376c-2710-4ef3-a242-2b68cec5bd69", "value": "93F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951378, "uuid": "678f25cd-f240-44fe-aa60-d7da963d4659", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951378, "uuid": "95d3ea55-fe78-46d7-80bd-cfe706b8d6b4", "value": "3072:YwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:YwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618951378, "uuid": "bf97c696-1e54-40db-8803-71e41a33800a", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618951378, "uuid": "c0e315de-cc70-4af8-a49e-eba20aa7e236", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951378, "uuid": "b4b25d76-454b-47aa-a5fa-3a2d7c8a41e7", "value": "1c3a0c58fe21c918450ead2478fbce1d1adc3eacd802353b4c930980c67ff2ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d3f1f6-a20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618946286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946286, "uuid": "905d0dca-1448-4216-bbb9-9c9d13289b2d", "comment": "Malware payload (Dridex)", "value": "01cb952e760deaccfcce24bb80710f99", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946286, "uuid": "e259dc68-2f5e-4d31-92c5-30605b386edf", "comment": "Malware payload (Dridex)", "value": "1c9ced5741b07615307dfb45c8496c4a771c43e0006e038d3970eb5081acc8f1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946286, "uuid": "dba892c2-64b5-4af6-aecc-e13e3cb5cbd4", "comment": "Malware payload (Dridex)", "value": "c98a8d9d3ca176cc7ba024e0b6565c5ab734b551", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946286, "uuid": "481b10db-10a1-479a-b553-5f5248d5850d", "comment": "Malware payload (Dridex)", "value": "427139404771896aceb4c9b7aed7307472c38e7272d67a314266e605b33f02377b16a1c8457fbf7bae6d29adc83e6380", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946286, "uuid": "e1a4d0ed-382f-4cbc-8e98-f0c99c510407", "value": "6CF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946286, "uuid": "35ee9ac3-79f2-47ac-b4ec-0e45c3b1823f", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946286, "uuid": "89a472cf-13ff-4598-8d7c-fc9cf92333b3", "value": "3072:QwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:QwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618946286, "uuid": "0a570d24-2e8e-4b86-beca-b4f9dbee2672", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618946286, "uuid": "ae062ab9-2668-4abc-856f-20f56768301e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946286, "uuid": "b1424413-12de-474a-9ae9-a887d6d003ca", "value": "1c9ced5741b07615307dfb45c8496c4a771c43e0006e038d3970eb5081acc8f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0e8692-a21f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618954058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954058, "uuid": "d03874fb-b530-454d-bd41-3de1f2593268", "comment": "Malware payload (Dridex)", "value": "d4cf843c543a30a3b177b81b4a2dc3ea", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954058, "uuid": "a8bd70ba-6220-464f-a226-69977d9d7212", "comment": "Malware payload (Dridex)", "value": "1cb0916bb273c175377c67dc832a9c20d120694cdf494e653365c3c9afe239c2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954058, "uuid": "d961494b-b03e-488b-ac74-8a52dd1e9c00", "comment": "Malware payload (Dridex)", "value": "5f2511cf0065fbe4ef9be14e470cd8eaf2803f33", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954058, "uuid": "72285e4a-0c80-4624-b0a0-a3c042e82517", "comment": "Malware payload (Dridex)", "value": "70d8c873ee890432b5e52d12f12226a0ed4ab6372a11f105f9451100fd0aee8252f4172daeeea740ca539f8593b97295", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954058, "uuid": "6ba59e82-777b-4348-a57d-efb643307150", "value": "56F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954058, "uuid": "861d24f9-867c-463e-b868-a11e12bbf1dc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954058, "uuid": "9832570f-0474-4063-b219-b16b9cd7022e", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618954058, "uuid": "fadc1875-a124-4778-b272-a0adf677144b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618954058, "uuid": "c5f8d0f3-b082-4f39-9f5d-11137b25a876", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954058, "uuid": "d9d87e31-a813-492f-94fc-1797b92922e3", "value": "1cb0916bb273c175377c67dc832a9c20d120694cdf494e653365c3c9afe239c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f03a63-a1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618899575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618899575, "uuid": "ada53b99-4dd5-44f6-a7f3-aa0870b9fb3b", "comment": "Malware payload (Formbook)", "value": "1c3075ea6370094c1f0b08c0e67fac63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618899575, "uuid": "9ec6db00-39eb-4bde-8f38-4bd9f2f89ccb", "comment": "Malware payload (Formbook)", "value": "1cb687fb145088863a9deb90dfac801c8d7bc03ea4938fcb8d800dca658b69e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618899575, "uuid": "88a29512-d0b5-4f4e-ba3c-31c42a17c068", "comment": "Malware payload (Formbook)", "value": "b050e73538a7c8a783b164c40bb4b42eff825236", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618899575, "uuid": "bc5f160c-6f17-40bc-81c4-34f0815d79f4", "comment": "Malware payload (Formbook)", "value": "25790c7db05e164a6a6ed732718233e232509e94999b44f943c50045ad51be7225a3453a53dd38d4357bc68669dbad19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618899575, "uuid": "34d2730d-9f4d-4703-a61e-40af083d46ea", "value": "0C155B5C721475DEDA6BD2758BA85C54EB503C7B434B820BE02731BAA97C883DF160FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618899575, "uuid": "7db8b3a2-871e-4757-9439-1ada5cb08f6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618899575, "uuid": "24fd0b88-f4c6-4ee0-abac-818202750200", "value": "24576:QcdIWmw+MJ5VEzeYSs13IsRRRRRGlzWh0appFFFpppppppFFFFFFpFpFFpppppFw:xhoMJDEzG21RRRRRGlzWh0appFFFpppJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618899575, "uuid": "ff0caf46-29f6-4f29-92e5-0d8192b7aa88", "value": 926720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618899575, "uuid": "2a072748-3ec7-42d6-97e4-8499fcbf779b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618899575, "uuid": "3aad84fd-4dd4-4b25-8c26-be54e2389048", "value": "9046- PA118- SUPPLY & INSTALLATION OF EQUIPMENTS OILFIELD EQUIPMENTS & SUPPLY - REQUEST FOR QUOTATION.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d03c678-a220-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618954625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954625, "uuid": "e769c583-66d7-4e89-8628-1a5a5e86c250", "comment": "Malware payload (Dridex)", "value": "904d38fb9b2df87444757c82af6df70e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954625, "uuid": "7d70a653-c769-47e1-8af3-ad2ad520c85d", "comment": "Malware payload (Dridex)", "value": "1ce4fbfc17544b259ec5f4a1ad47207e46686523af35c5ebb3a9f02efb649a9e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954625, "uuid": "591ec7dd-3c18-498b-bb05-028c042f11ee", "comment": "Malware payload (Dridex)", "value": "e31a0af3d1df66b89b4d45e770ee0e0341a0af94", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954625, "uuid": "983fc0d1-e71f-4601-8103-e3f82bea6940", "comment": "Malware payload (Dridex)", "value": "f7865dc379179f4e0999d3bd84c2d15862476fbd33de3f4f10d190464cda66d0dfcac2e89eba7adcfc335a5d61929a23", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954625, "uuid": "5bc3ff0a-cb39-4163-a00f-05d0ecf9183f", "value": "E5F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954625, "uuid": "2566de44-15af-4712-acbc-8bab36bd6aea", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954625, "uuid": "5ea86abe-b284-4562-8041-9f6e9f20d435", "value": "3072:rwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:rwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618954625, "uuid": "852e581d-c101-4d4a-8bb3-49fb9c1355f6", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618954625, "uuid": "e0db76c2-e123-454f-95db-6fa3bf6e27a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954625, "uuid": "88ff37b9-00f5-40e4-ad85-eba5980f378f", "value": "1ce4fbfc17544b259ec5f4a1ad47207e46686523af35c5ebb3a9f02efb649a9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6226d836-a223-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618955841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955841, "uuid": "94539929-b5ac-45a2-b281-4103ad1d51d1", "comment": "Malware payload (Dridex)", "value": "b258b84b8da8a0e95f514d9044a3b363", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955841, "uuid": "216a4252-c733-47e4-aa5e-fd9649bf76cd", "comment": "Malware payload (Dridex)", "value": "1ce7f9388e2604b16831ab5e0b723aa5c9986d01fc7c46ee334eabee7fcd6354", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955841, "uuid": "cebf9d87-58b7-458a-916d-cf6d5360129e", "comment": "Malware payload (Dridex)", "value": "78301719eb2fc5c000d914fafc3c8554300f0af4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955841, "uuid": "0040c688-815f-47fb-95cb-7423b5e2428a", "comment": "Malware payload (Dridex)", "value": "82dd4a811dd62e6d9574cc0bc215f53723ba7b1f426a2fbf2617c409fcc277eb2cc7ffb7882ef9402caa3a76fb02c35c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955841, "uuid": "ecf8b9e0-91f8-402f-ab8c-ba6c826bfc05", "value": "DFF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955841, "uuid": "df4b0156-959c-4c38-8d4a-3dfe5785fbf3", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955841, "uuid": "922afaf3-7230-416f-8b45-fb13359f5efc", "value": "3072:MwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:MwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618955841, "uuid": "3c122cd3-127d-4440-8f8c-1c2e07a273c0", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618955841, "uuid": "d1d36d5a-18fc-466e-ac7e-807cd7efc611", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955841, "uuid": "c2dfa0ad-54b0-42f6-beb4-46d51c679a88", "value": "1ce7f9388e2604b16831ab5e0b723aa5c9986d01fc7c46ee334eabee7fcd6354", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc6dcc9-a1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618914279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618914279, "uuid": "e43af172-a3e8-47cc-b350-f53fb108acab", "comment": "Malware payload (Dridex)", "value": "1915f7430d01561fab66f5dc7cfbba8d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618914279, "uuid": "fa73c2b4-950b-4992-8e0e-2e4507b87ffb", "comment": "Malware payload (Dridex)", "value": "1d27dd8cc7f0b458a8728decabc398fdd1d729041c34a5a85dd73a2c91bd3bb6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618914279, "uuid": "e0363318-2e8b-458a-b9bc-5dfb289f80f1", "comment": "Malware payload (Dridex)", "value": "35dbc96da5a15dc367749b5f5887bc767354dd0a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618914279, "uuid": "83b1188f-250b-47a0-b35e-d371b18ca264", "comment": "Malware payload (Dridex)", "value": "dafacaa4afded86d91b3bb971c001b679f216a9adcbf8a851c115eee42d6d08cfbe94e55d645000b23ab1753f92086ce", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618914279, "uuid": "08030535-15fb-4506-99dc-11d9973b81bf", "value": "52F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618914279, "uuid": "0727b089-c6ab-44be-a5cc-4a8ddf163b86", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618914279, "uuid": "76a6b085-1ec3-4428-90cc-a35b213c036d", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618914279, "uuid": "3269119d-cc5b-4d9e-a2b3-a9fe73cde592", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618914279, "uuid": "cc259d99-d6ce-45fc-af93-3005085f8d5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618914279, "uuid": "13ca2792-ec0b-45f7-afa4-7a6e484e9c5c", "value": "1d27dd8cc7f0b458a8728decabc398fdd1d729041c34a5a85dd73a2c91bd3bb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe56a64-a214-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618949610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949610, "uuid": "2e482588-a27b-4278-9c6b-ab242fd389f9", "comment": "Malware payload (Dridex)", "value": "172cdca22211a8d6ce0d4891aae70952", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949610, "uuid": "20b10a02-b1c4-4e47-b34b-b18fab603c8d", "comment": "Malware payload (Dridex)", "value": "1d315ee692159de3474786fde71bfd32ef97f1d09fbb59aa3dffdd1b86e81706", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949610, "uuid": "7f73419f-4a3c-430f-b9bd-3832dfa7530b", "comment": "Malware payload (Dridex)", "value": "fee5c72b7968be6416a1d6f88def709400de64cd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949610, "uuid": "6db879fd-a710-444a-8a21-b47422efd476", "comment": "Malware payload (Dridex)", "value": "7161e9b2699247616072d37317e319cecadecb1a170eab055c9533abc70a648a9985ec101af059ef9cda960c0b4f2bbc", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949610, "uuid": "930f22e7-894a-4836-ae8d-7b46601adb4f", "value": "62F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949610, "uuid": "efb53530-c817-476a-ae07-a1da459f1d70", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949610, "uuid": "59b7e34e-1b20-46e0-b54c-07faac2ae352", "value": "3072:MwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:MwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618949610, "uuid": "a6eeab3b-1277-4bc6-a320-615bd8022f1b", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618949610, "uuid": "6bac0a4d-37dc-40de-ba16-7c856e15479e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949610, "uuid": "67795d32-f8cc-4390-a76a-db1527bd31d4", "value": "1d315ee692159de3474786fde71bfd32ef97f1d09fbb59aa3dffdd1b86e81706", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0077ce9b-a207-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618943652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943652, "uuid": "d9abdf72-afb0-4510-9ffb-13a8f26d1b4d", "comment": "Malware payload", "value": "cc532bac0992897da1166d5c38dce391", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943652, "uuid": "055c748e-aa99-4413-9f13-bc01daa1add2", "comment": "Malware payload", "value": "1d3356aa44142a06ffc73150f41606c970174b7c5fc4f1e6cbd67cf4056a46f7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943652, "uuid": "d1a0030c-2628-4ef2-85bf-29aa39c788e2", "comment": "Malware payload", "value": "9feefd20a2b168a1e6116ddaeb4635cf599813ac", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943652, "uuid": "2b1d87dc-0051-4f31-a97f-26c86de5bd53", "comment": "Malware payload", "value": "84abf89d1e8ce5d06e21664c05eaab32e32e4bdd6f2a6eef9ea6b67cc9b164c261e27e4ef7eca5c6946195c0e1eef506", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943652, "uuid": "f27ded6b-f72b-4e13-8228-08dee44a2f0e", "value": "C6F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943652, "uuid": "f6c67737-b103-4f9e-9d1b-b93acb6e390f", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943652, "uuid": "d8bfbc48-0f4f-4d25-9305-35ae04830a68", "value": "3072:vwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:vwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618943652, "uuid": "3e38c251-ea34-44ee-be3c-4ac91bcf6886", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618943652, "uuid": "59dc12b7-175d-48de-ad8c-dc143a25dbc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943652, "uuid": "705bd89a-47e2-47d3-8643-8464fe851bac", "value": "1d3356aa44142a06ffc73150f41606c970174b7c5fc4f1e6cbd67cf4056a46f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764f2182-a16d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618877707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877707, "uuid": "b1f96f87-53d8-4680-9ea9-798fc4b95c6a", "comment": "Malware payload (Dridex)", "value": "3c3116208701866171f09a117e858e03", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877707, "uuid": "4ecffaad-ec35-4e27-9ee1-e811e23e7030", "comment": "Malware payload (Dridex)", "value": "1d5c1f67a0984dd68ec46a63e81f8b2593113a641da20998be9bb60c081ab785", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877707, "uuid": "7c740116-6192-4584-855a-41587d1ad513", "comment": "Malware payload (Dridex)", "value": "6b8e45eb16322b5f0bdd7459f1ffba02cae1dac5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877707, "uuid": "1c5da6e2-2563-4c9e-915b-3027000aef43", "comment": "Malware payload (Dridex)", "value": "9af177b540984c6de2104481c6714d8e64c9d5402a44171d28fdcc911a640ac7704abd63e6e1f74a6dd8d1285b9cf7f5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877707, "uuid": "4762ddca-880f-41f3-aa56-124bd2db3e49", "value": "41F3D088CBB3E4E6EFB3D37866F85E1B561574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877707, "uuid": "a97bb2cf-5ddd-48af-8a93-006372c68dfa", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877707, "uuid": "be629c82-0408-459b-93dc-2fc56ce3ef52", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618877707, "uuid": "e505d404-08e6-4198-abd5-f9d8a74e5dea", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618877707, "uuid": "c81de6cc-41a8-47a5-9c34-8e7373bcd216", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877707, "uuid": "202a89d9-5b12-46c7-b5e6-5cddabea3e92", "value": "1d5c1f67a0984dd68ec46a63e81f8b2593113a641da20998be9bb60c081ab785", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8534e625-a22a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618958907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958907, "uuid": "0911902c-fca1-42b5-9f55-7bfc47f995c7", "comment": "Malware payload", "value": "43a3a5e8a3a92179cd1c625523b11280", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958907, "uuid": "13b88723-b7bf-441b-a663-6ec0b5590cef", "comment": "Malware payload", "value": "1d8bcc0f2c2d192c6d1e69207919bb07092abd34e982de7c623f403ee141b593", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958907, "uuid": "9f038980-749d-4f00-a323-2ce9b1a836fd", "comment": "Malware payload", "value": "be7dd463d4c691e96db6fcddf46307f1a1a2d851", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958907, "uuid": "6de56d98-2886-47d0-a4b8-917830eabc77", "comment": "Malware payload", "value": "fad5981d63aa25daa177ba78584b19db789ea6bf8aaa7ea53739a1aa018c478297891409578cf760f463a594f0d97d18", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958907, "uuid": "4070b4b7-fa3d-4a28-bddb-195ac3f9e741", "value": "BEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958907, "uuid": "7d6703ff-db0f-476c-b77a-928805fdcc2e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958907, "uuid": "ad8d0084-9809-44f6-9134-1e3ea95af4ac", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618958907, "uuid": "49862c2e-68ab-48f3-a2da-db98681ebad8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618958907, "uuid": "055f4ff2-046e-42bb-9ba3-092a16f6b800", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958907, "uuid": "f9341abe-3191-496d-b984-5df9ffd8f3f4", "value": "1d8bcc0f2c2d192c6d1e69207919bb07092abd34e982de7c623f403ee141b593", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b851fb-a21f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618954339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954339, "uuid": "19ea8731-4933-4411-8c3c-c874523cec9e", "comment": "Malware payload (Dridex)", "value": "184ba83ad336fa18889fd6e814c7bbf3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954339, "uuid": "73ab3684-5b03-4797-b6fa-def256f3f825", "comment": "Malware payload (Dridex)", "value": "1e8892fdb9264851b3c0bb11d4874f7e880309084f62027f00a7d70f75571539", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954339, "uuid": "592f8636-a62a-4263-844e-8611c9ab20cc", "comment": "Malware payload (Dridex)", "value": "6a754a0ef0a8f27f75268ff2956c391505575194", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954339, "uuid": "ffefb614-d34f-4fa7-9958-2275436bddf4", "comment": "Malware payload (Dridex)", "value": "18addc62b0fbd76a40fb79ecae67de325f6ba38e2f148eaae726d71580b9563a519aaeb5711f7bc667f4e0bdadbc9f65", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954339, "uuid": "d3905049-0dff-4803-ae88-c972ad609d53", "value": "91F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954339, "uuid": "67db7171-d252-4c71-8a84-ba78cf43730d", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954339, "uuid": "829bd639-4618-478e-809a-10d3872bba7a", "value": "3072:swZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:swZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618954339, "uuid": "0689b724-f339-4fed-92fc-b2b846f73828", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618954339, "uuid": "6e4a287d-5606-465a-abe4-ef56d84b70e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954339, "uuid": "c58200d3-c156-44ae-849e-f64e44f1d207", "value": "1e8892fdb9264851b3c0bb11d4874f7e880309084f62027f00a7d70f75571539", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d96b96-a208-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618944097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944097, "uuid": "96cc681c-ae02-45d8-82fc-3c252ad525da", "comment": "Malware payload (Dridex)", "value": "cc596d365804ee1b427531b5fb034a99", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944097, "uuid": "f5078f13-1628-420f-b268-4b9356ae8bdb", "comment": "Malware payload (Dridex)", "value": "1ec2d4fe546304e4f9b3249f9759368eb8cf99a748a8deab7c229dd86ae512f3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944097, "uuid": "8525cea0-e2db-4349-b6ae-1dd099595f1f", "comment": "Malware payload (Dridex)", "value": "61b26c8d58c00d9aac744fe2d30a7d7e1f137d65", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944097, "uuid": "1ce42daa-a619-406b-87b1-c69c9455201e", "comment": "Malware payload (Dridex)", "value": "2b40241a29a20b97b766387fe71c409244a69277681f036ba0e9334fad96ff76c0c3867abc7d5f9cd0c74a0b42b2a312", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944097, "uuid": "b9c58330-fdcb-4047-a4cc-05ce5c672dd6", "value": "DEF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944097, "uuid": "072972ae-374b-4e69-87ed-1f2444b3c4d9", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944097, "uuid": "ea1b4d34-d2a8-463f-985a-55ef50580433", "value": "3072:+wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:+wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618944097, "uuid": "0ba55e72-d5b9-43c2-9341-4f17937eb707", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618944097, "uuid": "2273f77c-f4ea-45f1-87cb-15ded02cbdd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944097, "uuid": "0b04638b-ba93-44a5-b7e8-aa68791a252b", "value": "1ec2d4fe546304e4f9b3249f9759368eb8cf99a748a8deab7c229dd86ae512f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f776d2-a1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618928246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618928246, "uuid": "23174d8d-982f-4665-b1ca-e9c4bba69e03", "comment": "Malware payload (Dridex)", "value": "ca3be561c7c44b047e6801c47457ed25", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618928246, "uuid": "c50d9b1a-60a5-44dc-98d1-5d297b179306", "comment": "Malware payload (Dridex)", "value": "1ee6f7247ad2e1810680ab2a3755b5f3238b61a4c92450a25b6e75d4004889cc", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618928246, "uuid": "80309206-1af3-40b4-a789-019ce1d212ca", "comment": "Malware payload (Dridex)", "value": "108a8af678937f74b26d3e3067fcb63a62232c1e", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618928246, "uuid": "0c0d4fca-f027-43e5-bd04-761d6a65ed49", "comment": "Malware payload (Dridex)", "value": "189ded8ea1c7ea644f99dd9c4581a53e7d7e773ab0ee39371533c6674ae963f3736557d70841f4a90ff4a218b2816633", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618928246, "uuid": "733feaa1-1874-45b0-819e-a78dd2ffbf71", "value": "ECF3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618928246, "uuid": "a864e685-acbc-4a38-b930-6e1fdd106d14", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618928246, "uuid": "d380e396-d2fb-48a5-9c6e-e7c15d1e1ca0", "value": "3072:/iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:0eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618928246, "uuid": "4472ea4d-18c9-4aca-bb53-5b2a752e90e9", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618928246, "uuid": "61d51160-6295-40ae-88bb-55558ff2af3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618928246, "uuid": "bfda868d-ba8b-4f44-be83-4568f04fda09", "value": "1ee6f7247ad2e1810680ab2a3755b5f3238b61a4c92450a25b6e75d4004889cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d03ef0-a211-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618947961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947961, "uuid": "f9812c47-ebe2-42d5-b98f-551603029987", "comment": "Malware payload (Dridex)", "value": "a57ccf98d2d11b7dae409571573d0cac", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947961, "uuid": "cb7594de-28ed-4258-9bbf-4dc863a2cacd", "comment": "Malware payload (Dridex)", "value": "1ef9981ef8faa8ad9dafc114d8712f25b0fe8f704c342429ec2e1e27a6c13550", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947961, "uuid": "c98f5442-3c38-40bf-8781-0ef8928c48a8", "comment": "Malware payload (Dridex)", "value": "12af5f089621be3c2cc2b825c6a31bd449b795dc", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947961, "uuid": "e527b9a9-b589-4f77-a67d-d5da0075eb95", "comment": "Malware payload (Dridex)", "value": "8d35b9f3dac801bb5e46621c80ad996f468e56a443607f54e27b0af94d47e2b15544a2292cc0215541b799372e9a6ea1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947961, "uuid": "1abbc5a5-4b27-4e60-be01-a08613184995", "value": "5AF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947961, "uuid": "62497299-dd2e-4c73-8669-4685cba3e92a", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947961, "uuid": "e72b0a96-d1a8-465a-9c00-8d6decaf24b0", "value": "3072:mwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:mwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618947961, "uuid": "44173115-1850-49a8-bdc3-ea48f21e76cb", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618947961, "uuid": "af2d8924-ff32-457b-8562-908fd95c717a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947961, "uuid": "319619e7-3ab4-4e91-a848-738662d9405a", "value": "1ef9981ef8faa8ad9dafc114d8712f25b0fe8f704c342429ec2e1e27a6c13550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6d52b2-a214-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618949581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949581, "uuid": "98e892da-8bb9-406b-8685-cd230fedcdaa", "comment": "Malware payload (Dridex)", "value": "85f301fc1f37cb986a5d6a5bcd49116b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949581, "uuid": "81c50425-c8e9-4707-ba77-210951002e1f", "comment": "Malware payload (Dridex)", "value": "1f3061d65673b69018bfe85eb97f46d4f7cdf8626732de3ce831e6ee9c551df2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949581, "uuid": "5de59746-8def-4ae9-bd5b-0cf72e9d843e", "comment": "Malware payload (Dridex)", "value": "c17e3cce4af7a32f3579bc0bcc9c08d7e86fa706", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949581, "uuid": "daf030d9-2fac-469c-aafc-e6c5940187f8", "comment": "Malware payload (Dridex)", "value": "7f3b8c55bd329d343997386eb325aedafeef14b893edd43b9e799c8f8a5c01d0d73fe7be12b15ab28ea07bc99f90c58d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949581, "uuid": "60293e46-412a-4174-b382-ba835ee7baac", "value": "E0F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949581, "uuid": "2ff049a2-f31b-487f-87cb-710b99431461", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949581, "uuid": "81629720-db5d-4fef-a353-68f095e9a004", "value": "3072:qwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:qwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618949581, "uuid": "aadcb945-0c4d-4622-bd3c-eb23552a174a", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618949581, "uuid": "1736a135-f21b-4ef7-b5ce-af56fff0705a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949581, "uuid": "d9b7b904-2334-466b-987d-41300aee30ee", "value": "1f3061d65673b69018bfe85eb97f46d4f7cdf8626732de3ce831e6ee9c551df2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47586257-a214-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618949354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949354, "uuid": "1cca8c1c-98f8-45f9-b4b6-0e812de54435", "comment": "Malware payload", "value": "b2e4d5b6a2108ed667b30a41360e71c6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949354, "uuid": "9c31432f-f5f3-437f-ab1e-a07980927bc6", "comment": "Malware payload", "value": "1f32c2ca0b6a3690b823be6ae5a1aa44e21537c30a6b09546e8477fc2ae4f0db", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949354, "uuid": "ffc85641-e977-43e5-8a9e-96981f6555ac", "comment": "Malware payload", "value": "606ced58ce76f83f781281b552b64068b9bc4d4d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949354, "uuid": "a935bff5-dea6-41b3-a5b6-f689024f5cb6", "comment": "Malware payload", "value": "3bd67428f84a967e59ac83bc4caaf0a55d686f7bd763ff42d1b9de7da1610e0dfd49c8f7590e0dc910a683189c1d12f7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949354, "uuid": "6a8e9afb-240c-4ac4-bc03-b4b89152d1d1", "value": "5FF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949354, "uuid": "223af1eb-8098-4df0-8a53-d6fc3a032ab0", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949354, "uuid": "1497392f-a4ba-42e6-bf88-f0fd1528ccab", "value": "3072:IwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:IwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618949354, "uuid": "4a6d06f2-8086-4a23-a435-fb1de7652566", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618949354, "uuid": "decd5d18-7dcf-49e8-adef-a7212058c2bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949354, "uuid": "0f223557-3f0c-4ca5-8d64-b8ad64be4456", "value": "1f32c2ca0b6a3690b823be6ae5a1aa44e21537c30a6b09546e8477fc2ae4f0db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7be7554-a1d0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618920444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920444, "uuid": "fcb6bb30-6095-443a-a784-3574f8f48d17", "comment": "Malware payload (Loki)", "value": "60c6261496fe76453b469c0b6fb3ca60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920444, "uuid": "d6c3a62b-65b5-41fe-a028-635d3e7cc6df", "comment": "Malware payload (Loki)", "value": "1f36b91cb509815bd462aed405d2afbe26cded0fc48b34c9536e6145e51ff44c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920444, "uuid": "eb09b457-be68-4b89-8ec7-91e2022e41ce", "comment": "Malware payload (Loki)", "value": "9cc9a33be18df8cbcd44236bdbec14f82f75f92d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920444, "uuid": "36881a3f-6edc-43ef-b1a5-c1a03da3e8ef", "comment": "Malware payload (Loki)", "value": "e3661b76db91d46975be4b64565f7f05ee163a43363153ed6fad7f2cb7e160a2ab1667860a1896c1f934c3edb1b98dc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920444, "uuid": "14d48a9a-4922-4fe6-bb70-8df6edbd1517", "value": "AB35DF257FD58E69D2BA4F7848B4925493F9BC518F17C30AFEA135EC8E30FD46A12242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920444, "uuid": "644133dc-4057-47a9-92b8-7c04ad2b4811", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920444, "uuid": "af801413-e4a9-4571-9d3b-94130b9d2c58", "value": "24576:WsHROBOobXQRRRRRVnBqx/Narb7FjNAjS:WsHE3bXQRRRRRVBQaH1Nc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618920444, "uuid": "e891d459-4784-4342-9bbd-e23b30beeb48", "value": 1077248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618920444, "uuid": "540ed454-2ac2-4f0e-a5ee-e073521a0642", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920444, "uuid": "7fc6c12c-58cb-4ce0-a123-88db44340581", "value": "60c6261496fe76453b469c0b6fb3ca60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8060a89a-a22a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618958899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958899, "uuid": "9f8c60dd-879a-44cb-9d4d-5a34bbba5c9f", "comment": "Malware payload", "value": "6f153172fb0a7d54d94e691e5a6a4829", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958899, "uuid": "c976525f-eabe-4b4e-9819-2386f179581d", "comment": "Malware payload", "value": "1f4ec02240b7017ac402577abca77704b360f3df33bd46e9422a1d51036461e4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958899, "uuid": "b4eb9002-1efb-4928-a15a-2267fcf9dcd6", "comment": "Malware payload", "value": "74bf6383a165e8d70ac892066269ba6703e81fe2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958899, "uuid": "16bb1c98-a21b-42df-a698-088f1fee98d2", "comment": "Malware payload", "value": "8118ccdfd34669fe8f26a01234fab0b2cb4d4d6ff07aec9f8596841c108b5f20921c8a75137ee49291386ca997ac915f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958899, "uuid": "78445fd6-1f85-4c2c-a8e1-a2ddf90bfe6a", "value": "00F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958899, "uuid": "5df27a80-0d7f-4aca-b705-dd5884b91cf0", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958899, "uuid": "16147b1a-2ef1-4fd3-a132-aa4b34f99bc8", "value": "3072:JwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:JwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618958899, "uuid": "1264ff94-8208-4a9b-8aeb-881f3d1cfc82", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618958899, "uuid": "d4287d5c-0576-4aac-a5ea-86f0002cea51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958899, "uuid": "7598470b-3701-4d05-9708-9064aa6445fb", "value": "1f4ec02240b7017ac402577abca77704b360f3df33bd46e9422a1d51036461e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef9aed1-a16c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618877426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877426, "uuid": "43f14b7e-8406-4799-a021-2030d954fe75", "comment": "Malware payload (Dridex)", "value": "a13c164b2dbe4df6f6bb6c153feafab6", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877426, "uuid": "d76a3f2a-82d0-4d83-9098-cd1e7b48e31d", "comment": "Malware payload (Dridex)", "value": "1f5e5b566bf52eb86b3516777ce96864ae31b105d708319e10204da78dabcc92", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877426, "uuid": "9be02094-2753-44f1-983d-c5896fdb3559", "comment": "Malware payload (Dridex)", "value": "9ad07a717c0a57170f707c1c73199d8b151f6744", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877426, "uuid": "e82e0130-38cc-42e9-88db-95e862d5d535", "comment": "Malware payload (Dridex)", "value": "ec290ee73072c0fabea0fb5013e4bd9fd4a1079e27862ff80dcf15b2c0a7068ce56bceda506bbae63d0fca75166b7d5b", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877426, "uuid": "7b470c52-c404-412d-b84f-9de53c47ccc8", "value": "3AF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877426, "uuid": "991f732d-8a75-4bbe-abcc-421593fbddd1", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877426, "uuid": "4a847ebb-1d2f-401c-9253-feef1b25af70", "value": "3072:rWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:r42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618877426, "uuid": "853d6f9f-8b97-4e3d-8186-3f7e350683d1", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618877426, "uuid": "55c49d86-c066-49e2-a492-191842ee55c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877426, "uuid": "64cf4be7-778a-43e3-99aa-839bf5f2b2ba", "value": "1f5e5b566bf52eb86b3516777ce96864ae31b105d708319e10204da78dabcc92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ffde1e-a207-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618943694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943694, "uuid": "5ce1a6ec-0e23-4e8f-9612-69bbd5b6eda7", "comment": "Malware payload (Dridex)", "value": "b3b1c83eacd849529e0335a73b73b388", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943694, "uuid": "738d1aab-cabf-4adc-96d1-c3ddd3bf8040", "comment": "Malware payload (Dridex)", "value": "1f719381ac9482e19bfcdffebb4834a616f56c49db38fba02b4053d760174560", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943694, "uuid": "fa5acbf6-4831-4961-90fb-d241f245eca4", "comment": "Malware payload (Dridex)", "value": "c2878e32b7bb3b68003c9c49d999828fc72a7fd1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943694, "uuid": "24e0ad02-b6de-4f5d-9f2a-05705aa7bbf8", "comment": "Malware payload (Dridex)", "value": "3c1109360bad4a4a8c0e6578228a23f9510b8c80d3a130436c67e650d35d1cd70154ea953cb7a9e632ce3f62c16f8366", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943694, "uuid": "d80cc440-469f-4337-b8da-957421e35dc5", "value": "A9F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943694, "uuid": "48cf4926-07b5-4c9b-a9c0-3853408180c5", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943694, "uuid": "e7ef448c-ce8e-43b8-bff4-51ff303996d0", "value": "3072:VwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:VwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618943694, "uuid": "f99b4233-fcb0-495f-bae2-9f18b54276b7", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618943694, "uuid": "a3a85682-c94a-41c4-b373-9c4b0d62b6f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943694, "uuid": "eebbfbd1-992f-4165-8dd0-7b9664c896da", "value": "1f719381ac9482e19bfcdffebb4834a616f56c49db38fba02b4053d760174560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "489b22d5-a1f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618933894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618933894, "uuid": "b22cb898-9d72-4780-adf2-25f5769e0d9b", "comment": "Malware payload (Dridex)", "value": "ced1d7ef369392df66b6ef89087bf6de", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618933894, "uuid": "72e07e62-c205-48a3-9899-cb51b1bec266", "comment": "Malware payload (Dridex)", "value": "1f8eb00254eeb0b7eb0eb86a78b33df267ca3e4f19cc697dc604f16efd302fe0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618933894, "uuid": "6aeb0e75-b68a-457d-89b9-32b8794411b2", "comment": "Malware payload (Dridex)", "value": "5b94cd164c36cb885bd64b9d0ed93e09f9dfd6cb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618933894, "uuid": "abad8393-b812-457a-820d-b33e6c63b64c", "comment": "Malware payload (Dridex)", "value": "801fcc684dba2039dc77bd0f4e7ea8f226bb6234a1106a3324446107fd79a316bf4e1d8e121920ba033a3e301410d8ae", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618933894, "uuid": "ad8a5fec-370e-41c2-a87b-39a854ad91a7", "value": "D3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618933894, "uuid": "2dbea6f2-8e4b-49b4-8e37-d996feac6915", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618933894, "uuid": "d5afcaa4-d38e-4c7f-95ac-d6ec69ced841", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618933894, "uuid": "e89f0407-5aa5-4e3c-a083-033802e41b72", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618933894, "uuid": "a2808a62-fdc3-4ab7-be39-1ab6ae95f88d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618933894, "uuid": "5c08759e-4a9f-4079-a866-fc7cfa4117dc", "value": "1f8eb00254eeb0b7eb0eb86a78b33df267ca3e4f19cc697dc604f16efd302fe0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f31a3df-a221-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1618954843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954843, "uuid": "716e9446-ba0b-4f6c-8c8a-2bef53318f8a", "comment": "Malware payload (RedLineStealer)", "value": "32dbc1ba7d94ed0ed778c2e4e42d656a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954843, "uuid": "387e9020-6352-47dd-907d-f1a4f3279ade", "comment": "Malware payload (RedLineStealer)", "value": "1fb9884604c756b8cb315968847b11bcdda329e24a8b710aa4fefd95a880b887", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954843, "uuid": "157fdac1-ae04-4746-bb5a-d312c067ee17", "comment": "Malware payload (RedLineStealer)", "value": "defd8145629b189ea9ee4e9de962334038f352ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954843, "uuid": "806128cc-0774-4f64-be53-558c5dc7ea70", "comment": "Malware payload (RedLineStealer)", "value": "3612c752ee88bbc1be928e5acd16de5694556a41640fe10b476567d5f9aacfa04ab54fa29943ec6921008282a16814c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954843, "uuid": "607f4512-69a6-4e25-bdf4-568cbdd263df", "value": "C574CF127AD0C132D0826C754716C7B18E7E78717A69598BBBC45EB84F347F2EA3132A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954843, "uuid": "eed2ccb3-5bff-4461-ad40-1d20868acb80", "value": "0c1de0d2a8383c4df108890e036a0ae1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954843, "uuid": "da0ab8bc-a379-435b-959b-2c38121e8560", "value": "6144:/KJg6oYY2LhB02L7AL8TgswGejyGmDr5sgdPLsd/tZGXd2mX0nZ0qFVPuq6DbU:yJg6oOtBNHUGgsSwH5HoZuXOZ/PuqoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618954843, "uuid": "2980dd06-4b85-42f0-af70-4936e6ecec70", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618954843, "uuid": "1c60d357-63b0-4feb-b52b-3b56aa3c55fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954843, "uuid": "c418c01e-d0e9-4121-b306-7b14d08bb54c", "value": "1fb9884604c756b8cb315968847b11bcdda329e24a8b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b4f2aa-a211-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948115, "uuid": "c583b750-de5f-46be-a35a-aa81fe8589c2", "comment": "Malware payload (Dridex)", "value": "8c7b8c57fc8f7a0418e74e05c4a57a57", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948115, "uuid": "96ecba48-cee5-46ce-90a0-de9b02496275", "comment": "Malware payload (Dridex)", "value": "1fbebcf4b9d330dc413cdca07a4d670396ace845a218a08795b3a5f2f6245482", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948115, "uuid": "bbd17a73-87e5-45a7-ba1a-e7fde7721844", "comment": "Malware payload (Dridex)", "value": "f7855e07df4163e3d68dfd4638c6297e19079c87", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948115, "uuid": "785eb03e-1c3f-4005-b9a9-0b701d6e016b", "comment": "Malware payload (Dridex)", "value": "34a2da2cc6d557d7a7dd0237228a7c487c7aef44cf5d6f767cab7191273f932c2f4f027a71da6915545d80702ec63c27", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948115, "uuid": "78c643f1-b3ad-4df3-a3c0-2a1b33a994a9", "value": "74F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948115, "uuid": "4ca94454-3b19-42f2-b8b4-7192174fef03", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948115, "uuid": "594608d7-8cc5-40b9-9bab-345fe65d500c", "value": "3072:nwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:nwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948115, "uuid": "e4d3a463-ad88-4bf0-9c44-c93a386df916", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948115, "uuid": "a596d2e4-a1a1-4e28-b109-b228d93d3e20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948115, "uuid": "f23857ea-0c5c-433b-9e27-e2c431f339fb", "value": "1fbebcf4b9d330dc413cdca07a4d670396ace845a218a08795b3a5f2f6245482", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff750e8e-a230-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618961689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961689, "uuid": "7f9b3de5-e847-43a6-851f-256f48fcba7f", "comment": "Malware payload", "value": "0d393057885eb71bda46c23eb7dfcffe", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961689, "uuid": "3384927a-5703-43b9-b2ae-057093f9aac5", "comment": "Malware payload", "value": "1fd48f4153b5e6eea6feef596e6bf71bf4c75110acbf4d509afc565581bcfc11", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961689, "uuid": "dccf7d74-63c8-4894-a169-64afaf89a82c", "comment": "Malware payload", "value": "35bf6165c6ae7166533530ce1eb992a447d63ab0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961689, "uuid": "894b7eb1-c374-4d3b-a607-b7187af8917e", "comment": "Malware payload", "value": "eab309a97eeadb9612e7697543ea6ead64f99a0007d651dd71c3222ded7c2a5740c329f600abc752b6bbea04d941b683", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961689, "uuid": "337ad9f7-d587-4ba4-ae1e-70774e651c17", "value": "9EF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961689, "uuid": "36aa2af8-24b7-488c-b81b-febafebb22bf", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961689, "uuid": "c311be13-175f-45cb-9f52-7e2f77850c5d", "value": "3072:fwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:fwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618961689, "uuid": "ef01569f-1be2-49f6-8e99-77a8b6c05cc0", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618961689, "uuid": "3b8eef52-a2bb-40c2-ba41-c234753fc252", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961689, "uuid": "a6308339-7f40-4945-9da6-529ea69dc553", "value": "1fd48f4153b5e6eea6feef596e6bf71bf4c75110acbf4d509afc565581bcfc11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e074e4c-a21c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618952935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952935, "uuid": "135d6d0a-2f15-4bce-b7d0-cefd9b532a71", "comment": "Malware payload (Dridex)", "value": "5da2564cacf1650480ba94fa450fff1c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952935, "uuid": "b1b691da-a07e-4201-9db0-0bea7a7c59c7", "comment": "Malware payload (Dridex)", "value": "1ff263ecd1e2b9ef4d55d97eaf1a0d2f7edecb08b425e8c8652ef711c8037150", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952935, "uuid": "84b19e40-52a1-4e2f-a1e7-5dbfc575474a", "comment": "Malware payload (Dridex)", "value": "3f960b5938e76fa26ec2848989fb876a8ea5141e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952935, "uuid": "dd947bed-ee45-4ddc-a38f-d4cca2ff43d6", "comment": "Malware payload (Dridex)", "value": "b928130c125adfe913cdb005fcaa6001c3c634b581ca5889df52a7f671b34b09a1373cac443916f9b4908fd581aad946", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952935, "uuid": "cb438e62-c270-4604-9e05-d5971a153429", "value": "1AF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952935, "uuid": "5fc384b5-6245-4f96-a0c8-34b1e72b307a", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952935, "uuid": "a5d90360-781f-4207-90cf-2f391cc42468", "value": "3072:SwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:SwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618952935, "uuid": "03f03de1-d970-43da-b112-32df5b349b81", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618952935, "uuid": "2bab8bc6-925e-43fe-977a-2cd08f887b00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952935, "uuid": "2cd546e3-dc9c-443c-9a38-5ed22bc7dc11", "value": "1ff263ecd1e2b9ef4d55d97eaf1a0d2f7edecb08b425e8c8652ef711c8037150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746c14e7-a21b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618952436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952436, "uuid": "d2f757ac-9e0b-4a75-9467-c919bf17479a", "comment": "Malware payload (Dridex)", "value": "e41f0d8413d0488b6719d69e175e8bb2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952436, "uuid": "700d535f-d6f0-4524-b4f8-457bbda74771", "comment": "Malware payload (Dridex)", "value": "1ff942d2315f510426507659e3c30f07af14780922cf5f4d208f747b5ed1ef00", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952436, "uuid": "82b94453-ef7e-4b4c-a275-660ff3b04496", "comment": "Malware payload (Dridex)", "value": "1651a1f991035794b1430b403941edafef44befa", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952436, "uuid": "14c5f0a0-e6ef-46bc-9eaf-2aefa049a75d", "comment": "Malware payload (Dridex)", "value": "6cbecdc43a6d8c8312116b88186ad60473199865650276a0ce45147e374d4d14b9f133a16495934c4fd27013a885a017", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952436, "uuid": "d4613509-b0a1-429d-a611-bc18cae7906b", "value": "43F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952436, "uuid": "bea541a0-2464-4495-a577-7ccd4199e59b", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952436, "uuid": "298a04c5-7e8f-40d9-8753-a7144596a3a0", "value": "3072:DwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:DwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618952436, "uuid": "c44e4a46-417f-4049-8242-fee81ee72bd8", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618952436, "uuid": "c7259c76-8f15-45b4-bb1b-8a9738072263", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952436, "uuid": "9528c8eb-9583-41a4-9d0e-8fe61113675a", "value": "1ff942d2315f510426507659e3c30f07af14780922cf5f4d208f747b5ed1ef00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06bda577-a1e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1618929918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929918, "uuid": "e293256d-89c8-4622-800c-535109bf7f30", "comment": "Malware payload (RedLineStealer)", "value": "6bc89aea9b677fd03a86e3f8f3316029", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929918, "uuid": "7e5a9a34-d0ff-49e2-a7fc-4b5f97f4b9b6", "comment": "Malware payload (RedLineStealer)", "value": "1ffd8666e6b83fdc684f94a30747005ee9f558fc3ebc46cd7e78af0988f56e4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929918, "uuid": "5c1dae4e-b184-4340-afc4-a944539746b8", "comment": "Malware payload (RedLineStealer)", "value": "056a4c07992b1842d0b238f7d3628b2ddc9931ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929918, "uuid": "8ce6f04f-77e7-4bae-b978-3b264b3f86b6", "comment": "Malware payload (RedLineStealer)", "value": "0a6f45b87aa56864e2da68809f43e99e8dd4f6c7c15e62ca1eefd40501d48499065ac4dc870ec1bfb63e63d96b50feec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929918, "uuid": "0f997ba9-381c-4b82-a413-3333c1b380c2", "value": "0825AE213642DA89E03F9FB1646A815057F5FD8ED320CF0D3FA66E1D5DE370202967AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929918, "uuid": "38d3dd3d-d10e-4097-bcf9-ff15fd7478b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929918, "uuid": "b6a78b3c-d4da-4c56-92e8-8633c6c9ceee", "value": "12288:T20cWuFSzRRRRR6pECjQKrvW2w7Ail0H2zzjc5QSiyyjK:TwW3RRRRRrCjQKrlwzlg2z/d8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618929918, "uuid": "54687b6c-3857-4727-b8f9-0fdf713484d8", "value": 1040896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618929918, "uuid": "a7eb6511-1e18-4e0a-a981-09b164eb0f0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929918, "uuid": "36eb6ba4-6d31-4701-b272-a8d1ca2cc304", "value": "GMX099767322177656099PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428120cc-a222-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618955359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955359, "uuid": "fd9744e6-86d9-44de-b0d8-a1ecb79d5482", "comment": "Malware payload", "value": "86936b795935d0483ee7dd216786cf2b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955359, "uuid": "5e4a72ee-25cc-4b91-9c34-a179d858f4cf", "comment": "Malware payload", "value": "20336dc39e7fee59b580b9d435bd3bfeb8237cff94078cdf0df88508d17f3174", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955359, "uuid": "a7edc36e-0816-4a18-9f06-8c1554a6038f", "comment": "Malware payload", "value": "fa21bf0311575d258d05bdcbb56a84986938e230", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955359, "uuid": "c7405e6a-512b-4891-ac42-abf00388369d", "comment": "Malware payload", "value": "a987b41a30fb62c5d1348b1d51e133a2b0268586f4629dd7cbe5ce885a2b56f19805631a6ad95edf0be9f3010aa2c696", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955359, "uuid": "a60af5a1-b194-4633-88a1-b5d7419a76d8", "value": "E4F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955359, "uuid": "c45519fb-d4da-4ba4-99d0-64868b757dc4", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955359, "uuid": "98b7c3a8-250a-4bfd-a678-b23c55bfc4c0", "value": "3072:bwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:bwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618955359, "uuid": "9e7a8b58-1893-4a5d-ad2f-71369f0ec446", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618955359, "uuid": "fac05488-3a59-4218-945c-3372210efca6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955359, "uuid": "72c3c52b-ba00-4941-a044-7fcc4cb2f060", "value": "20336dc39e7fee59b580b9d435bd3bfeb8237cff94078cdf0df88508d17f3174", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce34c119-a21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618953875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953875, "uuid": "e33a64b6-fe20-41dc-a5c0-c38d21b164fb", "comment": "Malware payload (Dridex)", "value": "e6cc6b5de78c17294573f0950b8c2630", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953875, "uuid": "35c6cd11-ab23-407d-90f9-dc7b57666039", "comment": "Malware payload (Dridex)", "value": "207b52c7dfaec5f4b45a59192284b351335bc9c0b9b2527f7bb214a440c8f3e9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953875, "uuid": "ea430a8e-796c-4daa-aad6-9a202c6ab92c", "comment": "Malware payload (Dridex)", "value": "9a902f47eda0eb3a6deb95f8ca023b644cc95d0c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953875, "uuid": "13a9c52a-aa38-4409-aded-8e5aea3bd84d", "comment": "Malware payload (Dridex)", "value": "c538743a95de8170a2571c224492390a976b9e0f1fde45c8566b6fd0434c43720ef668e7d02c2b0fbb1e765d29c37452", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953875, "uuid": "3e30838b-342d-4b17-b956-276c70ba15e2", "value": "5DF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953875, "uuid": "7af3fa14-039b-42c0-bb0d-d2e6fbc4a7bb", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953875, "uuid": "e8b384e7-410e-42dd-b2f7-ab6c5a1d321a", "value": "3072:qwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:qwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618953875, "uuid": "d5d33872-3df6-41c8-a690-e62124ea022a", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618953875, "uuid": "9d9d04ab-f7c7-44b1-a629-c0206bc1df28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953875, "uuid": "ca301434-a05f-44e3-800d-a4b2532ddda0", "value": "207b52c7dfaec5f4b45a59192284b351335bc9c0b9b2527f7bb214a440c8f3e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6306bbf-a215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618950077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950077, "uuid": "92dbb01b-b6b2-47a1-8cb0-163695e3e3e4", "comment": "Malware payload (Dridex)", "value": "25632e4f8f37c2f36725f515f959fd0f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950077, "uuid": "7a3914f9-91e2-4f3e-82a4-4a64482c4fad", "comment": "Malware payload (Dridex)", "value": "20ac4de56f58ec5f453de9ae5e4879508281afdedca0105bd6fc52f7db78df37", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950077, "uuid": "b70ebe7e-2bdf-4c1b-83d5-4ee915e7f888", "comment": "Malware payload (Dridex)", "value": "37527762b7d4a19ef7ffc6d13a192896a7dfe17c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950077, "uuid": "10baabe6-cbe5-4021-bac8-f214ccc9d5cd", "comment": "Malware payload (Dridex)", "value": "fe806f77612902da9a7cee3af60599be04f96c7e183f65f055e8505cc949247573dabdf58b2b1d087c5385ca1cedad4c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950077, "uuid": "eba69a55-ef62-4b89-b9d9-a1347759378f", "value": "44F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950077, "uuid": "77d8a38d-4785-4d47-b64f-1c595fa4084e", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950077, "uuid": "8ef1e675-eebe-441d-b8ee-3001a2a437a7", "value": "3072:5wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:5wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618950077, "uuid": "224e1d4f-2bc9-4e43-b898-1e9755ee34e2", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618950077, "uuid": "11b5f549-eee8-4d4e-90a4-8069898abcf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950077, "uuid": "0aa80a23-a8ac-415f-97f1-526972ed677d", "value": "20ac4de56f58ec5f453de9ae5e4879508281afdedca0105bd6fc52f7db78df37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4b2137-a1d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618924264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924264, "uuid": "a92b7946-28f7-4d32-a26a-6de4732435be", "comment": "Malware payload (Dridex)", "value": "6f15ca8fddb4fec2e1dd48155ad6699b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924264, "uuid": "d01b5957-80bb-4c50-ba79-b375ae9e7509", "comment": "Malware payload (Dridex)", "value": "20b4395373ae6e4e86ca4a7f42c658ad645ade9acbad1a1b6af69f50df3e48a1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924264, "uuid": "5480ccd9-805e-46d4-bc3e-197d892b3141", "comment": "Malware payload (Dridex)", "value": "457300b19a4325b202c253dd699d400d373af2c5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924264, "uuid": "d586f7d5-6a44-428e-baa9-4eef6f6e3dbf", "comment": "Malware payload (Dridex)", "value": "423e5fc20f3508d309ba4974b96f290a0b1370f1df82f50c3c269abb6301bb2103125979956bbe5153dade2c8a221297", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924264, "uuid": "d9320aef-321e-45e8-8b1c-ca6c86a25f78", "value": "99F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924264, "uuid": "e0e997b0-41bc-42f8-bdc9-ad06e18be90f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924264, "uuid": "fdd5fb50-8849-4bdf-8b5d-6dfa610a7fa7", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618924264, "uuid": "22aaa728-b98b-44b3-a5bb-4dbc2b2956dc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618924264, "uuid": "bcf753d9-ff72-4901-8d85-9ff82151d09c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924264, "uuid": "1882549d-aebf-40cb-9806-acb52db21448", "value": "20b4395373ae6e4e86ca4a7f42c658ad645ade9acbad1a1b6af69f50df3e48a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3143c43a-a207-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618943733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943733, "uuid": "e961c89b-3c43-41c4-8d1e-9694da7bb53d", "comment": "Malware payload (Dridex)", "value": "c511de8ece6d9ebdaba9a49c10a18a1e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943733, "uuid": "9fcff659-586a-4327-8a2c-680a3d727262", "comment": "Malware payload (Dridex)", "value": "20b9da4c860bf28ffd0e785f30464afe45f96ade915f3cefd669a13ecfe7fafc", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943733, "uuid": "df77f74b-95be-44aa-84b4-21a6ec1f1c22", "comment": "Malware payload (Dridex)", "value": "7c7aa89a43b51e7adb1560e6ed71eb81906f6ae3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943733, "uuid": "a766733c-2924-4d33-8a64-d52a6d5a0c78", "comment": "Malware payload (Dridex)", "value": "acde9eb3c434c04a4a074e545b0f10668c7750a16ba99a668d8fba4f33d245113d1425204cd9e7222e867707dfa0e1e1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943733, "uuid": "ecfb8145-ab1d-4838-ab75-fb193a391ab6", "value": "C8F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943733, "uuid": "bd1d23fa-90d1-4ae3-974a-59544279f75d", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943733, "uuid": "667132a2-d750-4bf8-8c02-02a0800bb6bb", "value": "3072:BwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:BwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618943733, "uuid": "4b969fb4-08c4-4c17-89e2-fda27bf02575", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618943733, "uuid": "a296aec3-a5f7-4e3b-8f1c-dc462ad30c92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943733, "uuid": "fa7e822a-6c24-4706-8f0d-013d310a4bd9", "value": "20b9da4c860bf28ffd0e785f30464afe45f96ade915f3cefd669a13ecfe7fafc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25af6fef-a205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1618942855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942855, "uuid": "a2025346-a84e-4f0e-b8fa-d5a9ffbb529a", "comment": "Malware payload (Gozi)", "value": "ba1880ee1ca916f381646c5209d9b90e", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942855, "uuid": "13e66355-1c57-48d3-a012-902920c5ab21", "comment": "Malware payload (Gozi)", "value": "20c3671b0cb1d9ab33d5bbcd5c754098aacd8535d6dd2bf31b0271efc6566820", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942855, "uuid": "a287e2f6-262b-4303-b3fe-25ee65dd9fd5", "comment": "Malware payload (Gozi)", "value": "2906e474513d50385e31b1223a0bd9f77dace7c4", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942855, "uuid": "94a457c8-c530-4e61-b40b-f474f6fab724", "comment": "Malware payload (Gozi)", "value": "b26ec7738adb8ef0990a275e5a5622dda351454df1c00bb5dbfbc9238f5fe077a287c0bcdd93f826f5749245af7edf7f", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942855, "uuid": "1f472a72-0ab4-4912-b2b2-f258abaff6e0", "value": "3551C5AB6C979268C1CB25B6D93FD8DA9C244A120199D815C220DC740CB17E8FF967DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942855, "uuid": "b27b15c0-1b6c-468d-9336-fb90ab5b2000", "value": "48:iOAZM3I6qOiXHjMTmMqe/NQG1kCRAv3LOQA5gmA04oMLqYh80eN38d/IFrWZV:iOAZMY6qO0jKmMqkQgDRAZA5ZA0NMLqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618942855, "uuid": "4f7e7ec4-d788-4cc9-8383-c0ddd31e56dd", "value": 2893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618942855, "uuid": "bd7875a2-d030-42e0-973f-5286a0cd94de", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942855, "uuid": "19439dab-3e21-4ff1-8457-aa2057c2965f", "value": "memoryAQuery.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4ff567-a20e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618946737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946737, "uuid": "07c532f9-abb8-4140-a456-eb39aca8065e", "comment": "Malware payload (Dridex)", "value": "9ecfd9b07613b98362b908815bb77634", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946737, "uuid": "32ca2bb2-f5f9-47c8-b3f9-d25f1d6413fc", "comment": "Malware payload (Dridex)", "value": "20e6ca96be0c9cd3a8828d44a96eb2f2757cdbd30b9afa89f7857a6a8f2eb052", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946737, "uuid": "7f3e23d8-a0a5-43f4-9f9e-72159ae8db1b", "comment": "Malware payload (Dridex)", "value": "b51cefce9659996b57f8b7772784d60c8d62ff46", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946737, "uuid": "f9f15d0c-9381-4f65-97ad-c8d235e24ab0", "comment": "Malware payload (Dridex)", "value": "33f98069f003b5fa2e54e54cb145445a03c313a99e6eccf31ebac8d5141ba979a758129eec7288b324b2bb84d5ca7c63", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946737, "uuid": "1920a154-618b-4002-a81d-8d56e2a97b2b", "value": "AEF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946737, "uuid": "250607ea-0221-49ac-8f8d-dacf9c6459ec", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946737, "uuid": "c636a148-8289-4418-b6f8-a620e4f17101", "value": "3072:MwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:MwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618946737, "uuid": "b8770b7b-2c33-4535-9847-130578a531f0", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618946737, "uuid": "badcb73d-8e62-478e-b4cc-374a1fd24ff8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946737, "uuid": "1678e77e-90d0-434d-8ce5-fbd4b616bf37", "value": "20e6ca96be0c9cd3a8828d44a96eb2f2757cdbd30b9afa89f7857a6a8f2eb052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8417d6-a1d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618923757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618923757, "uuid": "690e745a-40b0-45d5-b524-b44ae9ebe6f3", "comment": "Malware payload (Dridex)", "value": "bf77eab784d6739919ca8c424a1c51d4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618923757, "uuid": "a90efeea-e5f6-485c-9ba5-02b0fdd79520", "comment": "Malware payload (Dridex)", "value": "20eba095469e9894260dd0e648ae5579c5a0a26af5f3a7f6b2e88ac4f5495952", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618923757, "uuid": "ab3fd4bf-47ef-47dd-9855-9873e657b597", "comment": "Malware payload (Dridex)", "value": "4a6745dffe49ff52bd4f7c772f4246ff4e69ae3e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618923757, "uuid": "0ef48d33-7812-4c08-b6c4-db3e6efa1766", "comment": "Malware payload (Dridex)", "value": "997ea08bded99705f72ee67cc56e03aef852003b497d56f70f5a05d38babcccef5946095503e0a5324959b30a1950480", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618923757, "uuid": "7e200acd-6195-4bec-9b78-795dd11f8bcc", "value": "CFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618923757, "uuid": "763e10bb-d786-44e0-9b41-bfac3f463c68", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618923757, "uuid": "624350b3-9e8a-48ee-be67-d256e9c4cc5f", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618923757, "uuid": "8d80b89f-9c8a-43f2-bdc3-fb46a9f434fe", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618923757, "uuid": "93c14f4a-96ba-4375-87c6-5a4099b94a5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618923757, "uuid": "cfd8d8ec-9ecc-47dd-bf20-c63ad36abb48", "value": "20eba095469e9894260dd0e648ae5579c5a0a26af5f3a7f6b2e88ac4f5495952", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0661475-a202-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618941880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941880, "uuid": "b74a92d1-c8e5-47af-be7a-bce6b7fb3939", "comment": "Malware payload (Dridex)", "value": "cbcecd79a4dab6294b0b80f41d9793e3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941880, "uuid": "5c0b68be-7ca2-43f2-b9c4-439d9f5289fa", "comment": "Malware payload (Dridex)", "value": "20fa245bb54f588be5fa74dad445f9db260b247bbff08d5133c2ef49b1ff2ced", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941880, "uuid": "043ce320-4f3d-4bdd-8aaf-1f2ab2beb677", "comment": "Malware payload (Dridex)", "value": "5fd86ae785447cf8638e7d26fee735d3ae8d4012", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941880, "uuid": "777ef781-28d5-46c7-a92a-6e799729d017", "comment": "Malware payload (Dridex)", "value": "f655ddd6c96b17a995adabbb5d979958e99572695ca4c0b1f5081223c85ceb23698e57ba8c1b694c9a5132c0a4605200", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941880, "uuid": "36ef2329-208f-426c-afbb-989761ef0ce8", "value": "B5F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941880, "uuid": "db2fdb13-3048-4b53-829d-f830f9c572fb", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941880, "uuid": "98c4fa7c-fda5-4bd4-97ef-63590a038416", "value": "3072:UwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:UwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618941880, "uuid": "4ba095e7-16dd-4fd3-beec-d015d4dc3fd8", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618941880, "uuid": "68b6893b-70d2-4b6e-8d4b-badf0b02cc7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941880, "uuid": "751ddb49-4ffb-4d97-89c7-a648b019d0b3", "value": "20fa245bb54f588be5fa74dad445f9db260b247bbff08d5133c2ef49b1ff2ced", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a91f896d-a22e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618960685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960685, "uuid": "cfb12320-5cc4-44b8-8196-bfa8ce13350f", "comment": "Malware payload", "value": "9bfa3915622ba4ab58bdd163aaa7e2d0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960685, "uuid": "3fcbd197-937e-4d62-bcf5-882d65e4fa00", "comment": "Malware payload", "value": "2106ca70e1f606beb0caa4d78b16727f51609108cece32c554806d85151e4f86", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960685, "uuid": "7d17d134-43ae-4dcf-8189-da2c7ccf87f6", "comment": "Malware payload", "value": "f6c5d0bd6fa70ced6c1603e20458f654e44c06fe", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960685, "uuid": "b5ead155-8ae1-4a03-9a10-25359b596982", "comment": "Malware payload", "value": "e362d7ea4ec8ae17a7eb198ee431263ec1cab9a024767b152b06d91832343b4326fe503cde5d64d2d0cd3c1140d02c71", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960685, "uuid": "c737032e-7ce5-4bcd-bc5a-beeca2e04360", "value": "83F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960685, "uuid": "4162338a-83e1-490e-96c9-21b3ce66d087", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960685, "uuid": "17291f16-f464-43e5-a918-19331999a820", "value": "3072:iwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:iwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618960685, "uuid": "d0068efb-5f71-4600-abdb-f3f7e41cb369", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618960685, "uuid": "3a844c19-a115-48d3-b432-a93d32712bee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960685, "uuid": "7d6487c3-a0a2-46bb-9f1d-ffd4b36da5ee", "value": "2106ca70e1f606beb0caa4d78b16727f51609108cece32c554806d85151e4f86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42354f5b-a218-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618951063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951063, "uuid": "7c1e53c9-d5e8-47d3-9198-c86c7bf6914a", "comment": "Malware payload (Dridex)", "value": "b6369c388ed020ab4b9f1be1694ea5df", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951063, "uuid": "0aa94541-4f75-42de-bc87-6e8df59914ee", "comment": "Malware payload (Dridex)", "value": "211abb797b15e4d806855dbc35a302987fa42e8c3ee44f68ab845d50b28a3ddf", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951063, "uuid": "eaeec07c-e2c5-4f3a-898d-180fe284b6e7", "comment": "Malware payload (Dridex)", "value": "8b4b7ac4bc4806fcfd7910d36093f9b4cef932eb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951063, "uuid": "5512e028-c4d7-43dd-bdaa-25b7c2aa4b47", "comment": "Malware payload (Dridex)", "value": "67f0f956b762e385dd28a26c12719b45dd94f72c86060df8dcbc8f6ca19cc85f0a6401c2ea1cf734750331b10c45c017", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951063, "uuid": "b18901a0-6ff0-4e04-be93-d59e444df6eb", "value": "42F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951063, "uuid": "1c3793a6-82c4-4ba7-a5c1-dd7c3bb39e95", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951063, "uuid": "d89767e9-2e4f-4ecd-ab51-90596fb5086d", "value": "3072:fwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:fwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618951063, "uuid": "fe7a45cb-c5f8-4dc1-9f80-04b096f48912", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618951063, "uuid": "1598aff7-1bc6-4289-b1a6-86005f20a99a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951063, "uuid": "b40a5d36-72ea-4915-b0d4-e836f52b3d85", "value": "211abb797b15e4d806855dbc35a302987fa42e8c3ee44f68ab845d50b28a3ddf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee04178-a210-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618947622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947622, "uuid": "7d59e050-e5f8-4ee5-95e3-f1043bf83cba", "comment": "Malware payload (Dridex)", "value": "585c432a258ec7137a5793f7dee7d517", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947622, "uuid": "7dbf3725-b371-4d44-986b-afabf52c1845", "comment": "Malware payload (Dridex)", "value": "215b1aa6a78eea2f77cac03abd68133fe0ed7706edbdb88b1a27dc5559ace960", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947622, "uuid": "d0beb545-f4df-431d-93de-d4d0f53af94e", "comment": "Malware payload (Dridex)", "value": "cbdf33f82a9d0eb966114a2ba29f35476e63dc1c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947622, "uuid": "c4ec7c1d-cf89-4fb1-a58a-75159a04a382", "comment": "Malware payload (Dridex)", "value": "8b912f0a1286ec5db3162abf7aef9bd55ad2d31dc824a8d8a1ed4de87c9c6adf0d13b506de40cfcecc2401adf21cdb17", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947622, "uuid": "76989fcf-bf59-4387-b1c1-4e6fb8f28aaa", "value": "32F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947622, "uuid": "faba1281-3ae9-4717-93a3-780a24ca2234", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947622, "uuid": "7a27a2ff-4c15-4118-942d-150b20d41ecd", "value": "3072:ZwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:ZwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618947622, "uuid": "846cf649-7a86-4d32-9795-e8e90ea57fb7", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618947622, "uuid": "8d959e6b-fdc5-4c4d-9668-fb6597d993fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947622, "uuid": "27a617cc-ce84-4130-866b-ec9105b45c2d", "value": "215b1aa6a78eea2f77cac03abd68133fe0ed7706edbdb88b1a27dc5559ace960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a0d64a-a209-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618944596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944596, "uuid": "b7f30513-230a-46b4-8e48-6bd331603113", "comment": "Malware payload (AgentTesla)", "value": "00cf7f73c9a203c347cd294a05831071", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944596, "uuid": "9d2bc1c2-7779-4318-be93-40d10a43066f", "comment": "Malware payload (AgentTesla)", "value": "216f7c44be6193c359ab1dc687dea34e7a3a3d46ad6b41faf646ed089955d874", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944596, "uuid": "de314268-9eb4-497b-a466-255bec8c9644", "comment": "Malware payload (AgentTesla)", "value": "2048c3def996307c241d82f018d283fc7ee1c555", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944596, "uuid": "e3061692-d7b5-4529-b4e1-cb29c9a0bb01", "comment": "Malware payload (AgentTesla)", "value": "b6132aae5b80aa0031826c300b60f9b7aff6bb896537a0f0ce5ac598bac67d98cf7f6a757ab639d7103759875bc1b91b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944596, "uuid": "4390217c-11d6-4a95-89a9-c91944bd90fc", "value": "8EC4BBACC08742D88F89ABB86B1F2F85114C7A6EF744A6337234977527E2C7B501697C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944596, "uuid": "c2390002-73a7-4736-8aba-9eaebbc685a8", "value": "6144:X5YYAmGLNloToFD9kW5M5sQL91+gb0B9b6clSrhus4U7h4hBjaYnompOcmjiGq7L:Xa7eF5/4GMjvFGRKIy80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618944596, "uuid": "95840f51-75a0-4c37-b8bd-6c7a932b7848", "value": 584196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618944596, "uuid": "917231f6-58cc-46fd-b8d7-b725f3fb730b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944596, "uuid": "689f74c5-c6f0-44c9-853f-ff9dab05ff9a", "value": "swift-copy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa98106-a200-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618940966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940966, "uuid": "5c011550-793c-41ac-a3de-4d46b74050b5", "comment": "Malware payload (Dridex)", "value": "8a5ce8e21118a0d5551f540da470762f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940966, "uuid": "94d17a78-0190-4f8b-be33-1eca28c0f2a6", "comment": "Malware payload (Dridex)", "value": "2177c809330575333b58ed0f11dcc953a5cf56ebf1bfa8ad6f99b124701fccb3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940966, "uuid": "4e8ce59b-1300-48b5-ab3a-d23195eb2ade", "comment": "Malware payload (Dridex)", "value": "d47e1775b7a7560a12d65a3bd4c681d7cfde9861", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940966, "uuid": "852245f9-f74a-429a-b389-22eec8985584", "comment": "Malware payload (Dridex)", "value": "5d3bbb789da99f914228d936ffa757d65a83a0213e5b4015180e13aac84decb43e75c9e275548191b74377d881fbf71b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940966, "uuid": "d602abca-32bd-4f6b-a1ef-c5afa656f548", "value": "34F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940966, "uuid": "bba31b74-a69c-450e-81ea-208ab9f9cf41", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940966, "uuid": "5b055d6f-96ee-4a5c-b664-d6abf545b87e", "value": "3072:FwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:FwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618940966, "uuid": "1ed38a53-a900-4949-be72-93602cec6fd9", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618940966, "uuid": "714633a3-cd81-4019-b833-74adcb1e66b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940966, "uuid": "cc9c0ef9-c5ab-4d5b-9d88-ad157ffce01f", "value": "2177c809330575333b58ed0f11dcc953a5cf56ebf1bfa8ad6f99b124701fccb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9188ea55-a216-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1618950337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950337, "uuid": "aa742943-03af-46cc-bc3e-a3e81cb6548d", "comment": "Malware payload (ArkeiStealer)", "value": "0ea36781a2dc764a8b7873c07f133dd8", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950337, "uuid": "9387af23-d204-4708-b364-08daffe3565b", "comment": "Malware payload (ArkeiStealer)", "value": "217db78c9cc58c32d0929a4814584bed2d51769697370e173402bef9fe1d9f05", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950337, "uuid": "c2cd88f3-2f8f-43e1-ab92-d70cbf2846ca", "comment": "Malware payload (ArkeiStealer)", "value": "14c9a912ecc8b062e795e4eac50dd17ae2633001", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950337, "uuid": "d344a7a8-d86f-4139-9d73-e2f766dc65fe", "comment": "Malware payload (ArkeiStealer)", "value": "779b236b1a60127480f2ed71f0e02d32f08dc09caf33deaf4d1543fee472cc56ea4cd544fe610c563afb81340c405e0e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950337, "uuid": "e467a3e3-b066-4bf0-98b3-f2af4970f037", "value": "D2D4021233C1C433C09B25B6451ACBB54A7EF87455695A8FBBD91EBE1F307D2A63830A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950337, "uuid": "791652bc-ca0c-4797-8537-c269543a1134", "value": "69c19434ab9608c2160111ef83774fe5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950337, "uuid": "ff4fcdf1-4f58-4a9f-97fc-8749cefe96c2", "value": "12288:pgHSF7UKQ9qwyNavIKjQBZt6jng9elmzvD/LOaxPPuQNgSwThOcyO3oTfOD6HKK:pgH87UKQ9PsaQEQ7cDozvDjOaxPDwT5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618950337, "uuid": "3894652d-93a3-4598-9e14-b14a1c91e2e1", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618950337, "uuid": "f177bfb1-b543-4d57-a08b-650f73e3603a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950337, "uuid": "aac0eb74-499a-4eb7-b885-e5663abfd0e8", "value": "0EA36781A2DC764A8B7873C07F133DD8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4137afeb-a21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618953639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953639, "uuid": "cf0cf423-ea56-4b35-a228-da9a51d9945c", "comment": "Malware payload (Dridex)", "value": "ce74c30874e1c805549702d95353cd79", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953639, "uuid": "5df096f9-8397-4da8-982e-81673e442188", "comment": "Malware payload (Dridex)", "value": "217fbea648db1e82dd9ae89e039dec02a6cf370de9c89b5ae89bf82433fd18ae", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953639, "uuid": "dd7dd162-5541-428f-8b94-02cdb623837a", "comment": "Malware payload (Dridex)", "value": "403e2f6d4a423d03011a026da6b6e4ea517afcbf", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953639, "uuid": "903f3674-00be-49e4-9b0d-1a8a5bf21d75", "comment": "Malware payload (Dridex)", "value": "3fb6adeb541218a54343ba7fa9d1d915abfa562338e3bd26d3446c62d20f4b9f6bb517d633058eaebf8573c4090aad40", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953639, "uuid": "1b2ac3c3-cb4e-45d3-bd16-f7465d213530", "value": "14F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953639, "uuid": "3b4bb3a7-8c7d-4f4e-8622-4a0b0d997fa9", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953639, "uuid": "691982e1-40ff-4d11-a3d3-c70987e9fe3e", "value": "3072:hwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:hwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618953639, "uuid": "0d6ded58-5d12-4be5-9342-92fcafba13ad", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618953639, "uuid": "a121acde-2285-4cae-99b1-02375be396f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953639, "uuid": "0b801a34-0a7a-4a6f-b642-4eb6e0b51b2e", "value": "217fbea648db1e82dd9ae89e039dec02a6cf370de9c89b5ae89bf82433fd18ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424355bb-a230-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618961371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961371, "uuid": "ca18fd65-f358-4431-bf7a-c13ed3e7a41f", "comment": "Malware payload", "value": "c9a59c8378136cd3d3394545d7d6a326", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961371, "uuid": "161d9990-aafe-4166-b060-cf5ff0148dac", "comment": "Malware payload", "value": "218b74856c6a7f3edb03fac5ee23e6d9286275981dcf895dd10dbb0532b9014d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961371, "uuid": "682da8ae-b447-4d0a-a775-209885137f62", "comment": "Malware payload", "value": "de45131ea250e986aba73ff6e133ad7a5b1d32f9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961371, "uuid": "dd48e05e-bc0d-4e9f-9b59-40720421a82c", "comment": "Malware payload", "value": "3554fffb81353d37937d72f95d1f7cb765e4620fa809e96f7c4610c210dfe105f99d3e3936563ba869d6748dc896f0fa", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961371, "uuid": "b834fa7b-973f-46ab-a5ce-3f0e48b40d9b", "value": "B5F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961371, "uuid": "04d8b494-0c16-4cea-838d-131c443a8e51", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961371, "uuid": "45f5845b-d9e1-4a40-b4e3-dcf7a990a476", "value": "3072:cwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:cwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618961371, "uuid": "03ec95d5-a325-44b7-8422-eaa7bf5c9688", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618961371, "uuid": "4afa490f-d249-4690-b549-bccf070bfb9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961371, "uuid": "711ab66d-bd5a-4c3a-ac3b-da77c7ec16b7", "value": "218b74856c6a7f3edb03fac5ee23e6d9286275981dcf895dd10dbb0532b9014d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c412f303-a16e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618878267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618878267, "uuid": "cd64a287-0e89-45c5-87fc-fbc20a9bce11", "comment": "Malware payload (Dridex)", "value": "aedbd86145dfe32cd4905a3f23e529ef", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618878267, "uuid": "2f1c4b16-fe99-4b02-9ff5-5142e6e62dff", "comment": "Malware payload (Dridex)", "value": "218c04c6458bd0f967698caa2a4792e7c2bc5ed03beb048fda892ff68272b648", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618878267, "uuid": "d61dc880-76ea-4f2a-8726-2ff84ace6654", "comment": "Malware payload (Dridex)", "value": "48cbad8029447f18e317d0af27090e5756bd7117", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618878267, "uuid": "2c046cc5-31b3-4faf-95e9-3e7c144e7a71", "comment": "Malware payload (Dridex)", "value": "70baefee5cc6014e6754c68258a5df767f28beadadf67b09b33af6385ceeed20f877f3f2b96f8f226d473d15299dd63e", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618878267, "uuid": "c5c177f9-3bb0-4e54-a1d5-82b87ebba69d", "value": "ECF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618878267, "uuid": "bc3b820f-730a-423a-8870-bc03e30586f3", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618878267, "uuid": "3bf0dca5-e7bb-4204-9707-f9a137e2ad2a", "value": "3072:pWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:p42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618878267, "uuid": "3a51aa21-ef19-4ad1-a253-b1768f2f1aae", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618878267, "uuid": "a8fea34d-c5c1-4de1-9502-f3fd382002c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618878267, "uuid": "4bff07be-7f27-49c6-a1a9-ec9a7dab1b55", "value": "218c04c6458bd0f967698caa2a4792e7c2bc5ed03beb048fda892ff68272b648", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e0a3de-a212-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948680, "uuid": "476e6bcb-16fc-4d85-a719-f38f1b114b49", "comment": "Malware payload (Dridex)", "value": "761966c3d3b9109dbe525d18e511ac26", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948680, "uuid": "3940e96a-378d-4206-bb94-466019a5fd10", "comment": "Malware payload (Dridex)", "value": "219c1742c05388ed81397c906f242a955625711d656422eb22e728891f035bea", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948680, "uuid": "b7940cac-1e8b-4466-86de-cc77359c6f73", "comment": "Malware payload (Dridex)", "value": "10b73eb603d24585acbbe89cc9df335fc6151ba8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948680, "uuid": "1b1cf8f9-ae41-4580-a9a3-98976950d5f2", "comment": "Malware payload (Dridex)", "value": "801429798d6c36a691bee98a715d2392373b6826c9469653912106732e5963fb3c483f9235489fbb41b9df45f8014144", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948680, "uuid": "2cce86b2-1be0-49a6-9e4d-032ec2fec53f", "value": "50F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948680, "uuid": "59cbb7c8-9f81-48be-ad85-f86f191a556d", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948680, "uuid": "7fd542c7-6643-4b05-9b8f-f71aa6cc8423", "value": "3072:bwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:bwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948680, "uuid": "c145cc85-def0-4ac8-aca3-88d58e655cf4", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948680, "uuid": "5355faf0-c543-4c47-9491-be1de0fa02f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948680, "uuid": "e0350bc6-8f69-4923-b7e1-e3fb3625682e", "value": "219c1742c05388ed81397c906f242a955625711d656422eb22e728891f035bea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c024866d-a210-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618947839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947839, "uuid": "86c1b128-bd49-499a-9067-d1650df13484", "comment": "Malware payload (Dridex)", "value": "c75a36c1970796301c673371ff0741fe", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947839, "uuid": "925497ea-19f3-44af-a93a-17d2cecb14ba", "comment": "Malware payload (Dridex)", "value": "21e441e013037809621499e33f876ec2eee53eaac724cc64d68e3c6ef9ec650a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947839, "uuid": "06b6f5e9-7bd4-4a0e-a187-7026ad00ba61", "comment": "Malware payload (Dridex)", "value": "dbf640a44789c4144b3855f74ad81e388958b816", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947839, "uuid": "beb0cd76-3cce-4b91-954d-7a49e91d1ae1", "comment": "Malware payload (Dridex)", "value": "e478ac686cf4de552a4bc387bbb4e5561ea5d62c5deeac1e46386ac49b4816121a9c7a8db4e63e40dafa5d9f2efcbf1c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947839, "uuid": "628f35ef-3891-4c7a-877b-b87a1c0c19f5", "value": "4CF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947839, "uuid": "853a6839-eff6-48fb-91a5-731747057362", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947839, "uuid": "1989800d-db5c-478a-a39f-dd4291165588", "value": "3072:xwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:xwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618947839, "uuid": "e90fb939-0ccc-47ab-930a-bc088dad0c24", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618947839, "uuid": "08f4c210-0201-467b-8eac-0819257b5f5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947839, "uuid": "09bcff86-f816-41ba-b7f0-55fef03e91e5", "value": "21e441e013037809621499e33f876ec2eee53eaac724cc64d68e3c6ef9ec650a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8137507-a205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618943128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943128, "uuid": "14eefc9f-2021-42d4-b974-2674fa4989af", "comment": "Malware payload (Dridex)", "value": "ce59cfcd4d9fb206079ae9aaedcaa0b9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943128, "uuid": "6b0dacf3-9462-4d67-8cac-46583016e0bb", "comment": "Malware payload (Dridex)", "value": "21f119fdefed5483fa91c948dca737c165c202a56971509f066d896d0579af31", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943128, "uuid": "f5914f7b-a48f-4f39-a4c1-9bd48f3e06df", "comment": "Malware payload (Dridex)", "value": "41ecc3bbab8081d9474d91667b2ec45ea72ac359", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943128, "uuid": "90308817-1291-4161-bba9-aa867eaaeaaf", "comment": "Malware payload (Dridex)", "value": "eae1a7f9ddcf2ee43a01e5f0634dbfb7ef01845c1a021fcbe672263280dd26a84f45e60a4dcdfc5c7abe669d7bd68163", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943128, "uuid": "a449864c-a50f-413c-985f-63ac859c6648", "value": "E4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943128, "uuid": "3783466f-1238-4d24-a899-f284abcf237a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943128, "uuid": "44d0f662-8537-4314-80af-2bba5e688649", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618943128, "uuid": "57f24557-3cd9-4540-ba39-83afa4c557a5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618943128, "uuid": "dd1765f0-0f44-4ee9-a1f2-3c3e0f9331e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943128, "uuid": "231e2d3c-2f4a-4be9-be38-36b070d641b6", "value": "21f119fdefed5483fa91c948dca737c165c202a56971509f066d896d0579af31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf5d5d8-a218-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618951214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951214, "uuid": "632996d0-267c-44be-9f44-5452dd463e3f", "comment": "Malware payload (Dridex)", "value": "813de2a5c105141bfd0d1661cb449d0f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951214, "uuid": "6bc4f8b0-3f78-4176-92ea-b462f058d408", "comment": "Malware payload (Dridex)", "value": "21f1591603c511205604ef2427c9564b68fee80616aafc6ae82dc98498a3daf5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951214, "uuid": "e71349b9-8f90-4c80-a2fa-f3f7c0671436", "comment": "Malware payload (Dridex)", "value": "969404e82de9372731c352ee3fbcc176d74f9acd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951214, "uuid": "4d665d2f-25e4-4550-b16d-15dcf4d60764", "comment": "Malware payload (Dridex)", "value": "1b90788e2c4ad77c0b5bfc3f50de746ea431a4e2a1c971d5aedf81a88ed339c83126e5bab042615027634a9a5b689fc4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951214, "uuid": "6d21b6e3-1547-4afc-b0a8-865a206bbc83", "value": "55F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951214, "uuid": "52de7fab-4230-4c01-becd-8886473bd282", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951214, "uuid": "b958ad62-1e5c-4c9f-9ac7-661cd9d6e34c", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618951214, "uuid": "a617220d-86ab-4098-962f-06c45f0a8b7a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618951214, "uuid": "65c7d4b4-f854-47d4-ac12-694d4b3239dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951214, "uuid": "d5382690-f6f5-4910-8879-e74f0a982208", "value": "21f1591603c511205604ef2427c9564b68fee80616aafc6ae82dc98498a3daf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb9d8a5-a22d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618960319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960319, "uuid": "aae5904d-4493-459d-b03c-3b4374390ec9", "comment": "Malware payload", "value": "cc7cd7be983a109274d531c02fc626ee", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960319, "uuid": "5ef97b96-2e76-4c17-82b6-aa3b6a0a3a01", "comment": "Malware payload", "value": "21f30106446b842696a3868db106c72388f66dba3beff72e734cc1b8aee6ccfb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960319, "uuid": "1c72d8bd-620e-410f-9eb3-448f22c11c71", "comment": "Malware payload", "value": "24f34f4d14f18e088b525a9e8f71d41d96d5dac8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960319, "uuid": "d4c71d10-3fb9-4820-9899-687276b862cd", "comment": "Malware payload", "value": "16e22c9ffb0c4a4d61ce203331dc2e045385b44ecdcfdca6791aaf3527bff04fce8497bee4c593d654c03bfb2cc93306", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960319, "uuid": "db6dd0e0-74fd-499b-9882-5416e7375674", "value": "30F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960319, "uuid": "dd060e0d-e6cb-4310-be5e-b38d897ff6f2", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960319, "uuid": "ff462d71-139c-4d71-b164-8bc0e61036db", "value": "3072:CwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:CwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618960319, "uuid": "65c3fe89-e88b-4112-b9fb-370dfbdb5d3d", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618960319, "uuid": "58e0f4a7-63cc-42a7-8930-6ec44a5770e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960319, "uuid": "aac310de-acf0-4275-ac57-85dce61aef57", "value": "21f30106446b842696a3868db106c72388f66dba3beff72e734cc1b8aee6ccfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd4a657-a231-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618961899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961899, "uuid": "191534e8-5f27-490e-a666-d3049838e8fc", "comment": "Malware payload", "value": "22a804efeb3808b10c1180d57533f318", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961899, "uuid": "e722cea5-1194-4d37-ac76-263f4678eaae", "comment": "Malware payload", "value": "220c2d760da8f114c7b0e5f2da9f8de8238e9c108420de95f35761c2f0a3dbd6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961899, "uuid": "dbed407c-98c8-42a2-81ab-f715708f8056", "comment": "Malware payload", "value": "46d567fffd0df0be6fcf03f8e195767ff22cd26e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961899, "uuid": "558ef050-3e4f-4dbf-8538-d95d4af656c0", "comment": "Malware payload", "value": "fe48252d06a9040c2469c72e3f214d60467cb93769c17e0cdad96bdf0c00763274c68188e4033cc36076ede861e35148", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961899, "uuid": "b5e3d367-50c1-48db-a78f-82b4cea07228", "value": "40F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961899, "uuid": "d8060e59-aa0c-4227-991c-ece49318551c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961899, "uuid": "2f68c3b8-2444-442a-bf7a-263e1043ddb8", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618961899, "uuid": "92af1b7b-66a2-4dc2-aa1d-f4e7fd28eecc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618961899, "uuid": "fcf4aa58-73de-4c9b-8a15-26d2466bc80a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961899, "uuid": "051be309-ba36-467e-9135-f5d1b7d2b86c", "value": "220c2d760da8f114c7b0e5f2da9f8de8238e9c108420de95f35761c2f0a3dbd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2032f6-a1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618928397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618928397, "uuid": "7620f5d2-f17c-4149-9edd-9f8f4cceb533", "comment": "Malware payload (Dridex)", "value": "c4766ccdac3f04fdc3b138dc6e816c1a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618928397, "uuid": "a20c16cb-fd28-43af-bec9-28fce31098d4", "comment": "Malware payload (Dridex)", "value": "2217ce12c914a19f4f33e2beb010f25bd0e513f5d74eb7c42e9f95ec3d012dde", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618928397, "uuid": "7b2d26e7-3fac-47ce-a949-075bb4dd8b92", "comment": "Malware payload (Dridex)", "value": "9ffbf9b7a4f5b751b2016a26e32efbed1bb08a2c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618928397, "uuid": "6ebf349e-efbe-4b94-a641-97eefc79eb75", "comment": "Malware payload (Dridex)", "value": "96b789f254e7b65c03ab1fba2fd64db673eb9473d8d6ab960ab4a3b843df515daa5d84607174fbc28145e32b25364bf4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618928397, "uuid": "beb28d33-45a2-4b88-9b5a-9da1db3fe4e5", "value": "CCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618928397, "uuid": "2e52ea92-e898-4d41-8fb1-f624785f47b8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618928397, "uuid": "c2df3820-2207-4510-88bb-462da1a64fa1", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618928397, "uuid": "23e129d9-0777-4552-98a7-db17ee4f21b1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618928397, "uuid": "2f0ef886-b9ff-4a9c-9e55-d908684da58e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618928397, "uuid": "cf8d8bc3-ed5a-4e71-b855-d8dbea0efad5", "value": "2217ce12c914a19f4f33e2beb010f25bd0e513f5d74eb7c42e9f95ec3d012dde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a9b6c9-a1af-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1618906212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618906212, "uuid": "05634b8b-bff6-49d3-b56a-ca5178507f2d", "comment": "Malware payload (NanoCore)", "value": "0fc7068a35c787d25d992c846a373bf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618906212, "uuid": "dcbe83de-6364-4ff1-aec3-702f3d35559e", "comment": "Malware payload (NanoCore)", "value": "224d22f8d4aef39961b2c0c2bab7c06b97636a7027932e573e338cbb69aedcfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618906212, "uuid": "b26f583c-02bf-4be2-9e33-94a431288a9e", "comment": "Malware payload (NanoCore)", "value": "bbb040c219965672c886f053b6d65a153774f1c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618906212, "uuid": "c446962d-fec9-4d34-94e1-4fd2e93112f2", "comment": "Malware payload (NanoCore)", "value": "46ff18f924d721b3a03f30820f406a36bc5cee9996806690aec052dcd8c5465fc0fa6364dcb2ae7c01b6cbd1855e34f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618906212, "uuid": "fbcd32d0-0e34-44da-bde6-6ab5cccacce2", "value": "EF45CF216FD48E1DE27A0B7844B8931483F8AC518E5BC7C9BEE734DC8DBCB955B42252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618906212, "uuid": "3b041e6b-cd5d-4a24-af71-1133df5f708a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618906212, "uuid": "c53af8e8-48bb-4d77-be1d-a80d3996fd0d", "value": "24576:P+RROBOobXeRRRRRv6ZaqZKZc5t3ChsBa0:eE3bXeRRRRRCaqZc+tq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618906212, "uuid": "d5e3d3d2-e77b-4ecc-9c1e-a5ab7e2b391f", "value": 1195520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618906212, "uuid": "0225cb82-7e7d-4d5b-863a-0f5decad6055", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618906212, "uuid": "297966b1-63f6-4fde-b6e1-5699d8297d10", "value": "April Demand.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e62a345-a1d6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618922737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618922737, "uuid": "99169e48-3ce7-4711-b2f8-18d898d1b232", "comment": "Malware payload (Dridex)", "value": "227805a6354caf19f8a92c1b79438432", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618922737, "uuid": "a8ce73b2-5cc5-4d6e-bca9-0a1fc77cc9b9", "comment": "Malware payload (Dridex)", "value": "227584bc4ec923ab0e989e7c1f5da633c38fc2dd075686c1a15c5af4e1e61774", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618922737, "uuid": "d40590d3-a9a5-42bf-9197-edf36ee845a5", "comment": "Malware payload (Dridex)", "value": "71b380872f69ed0ab7c8f5ce6ba103005885b1e7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618922737, "uuid": "a7fcb336-60f9-4bf6-97f3-a483c1b331bd", "comment": "Malware payload (Dridex)", "value": "ad61da341a99a2179460ce91ad146d6e4327bff77780d9374306d2a5b5bcbffeae86bc1ab24397b941efac773e72c764", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618922737, "uuid": "7684edfe-6eb7-4f15-8329-4a4a45421511", "value": "7BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618922737, "uuid": "b18f02fe-68cf-481a-8ff3-d44f55f7c92f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618922737, "uuid": "f38cbb4e-b638-4f54-87a2-8f306c8b8495", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618922737, "uuid": "3f63d340-1bc0-4fd7-9870-276ce8693751", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618922737, "uuid": "5c699f45-37be-4504-aa38-3b5d07a366ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618922737, "uuid": "ac65c57e-b481-4c1e-82e6-045c86f8fe7d", "value": "227584bc4ec923ab0e989e7c1f5da633c38fc2dd075686c1a15c5af4e1e61774", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b7671b-a1d0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618920394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920394, "uuid": "7f878705-050a-441d-8847-b16dc0c74d50", "comment": "Malware payload (Dridex)", "value": "92f1a98f6ee0daa60ec86be812f1ecc1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920394, "uuid": "d8a1506f-049d-478a-bf00-398d1ac7995e", "comment": "Malware payload (Dridex)", "value": "22863ee385a1cba0d455792fec3c1af61b61eecb3e35b4b2fd68b3fccdef8b4f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920394, "uuid": "580a7643-8fea-4348-abbf-8bde0cdb67d3", "comment": "Malware payload (Dridex)", "value": "5f919c91ba68586325987c18bf637bca9fa84ff3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920394, "uuid": "1089e760-a296-4dec-8cc4-805b6224790c", "comment": "Malware payload (Dridex)", "value": "e3c23986cd80d1923db9f2af23b75582398e0467c350abe603227e760365730a22913da39f3d43ce0d6214ed97307495", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920394, "uuid": "71bdef33-f516-4bfc-9596-2cea20d6b382", "value": "8BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920394, "uuid": "324e595c-5df1-45aa-a27b-4901b3511d22", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920394, "uuid": "8cf95df9-fe73-4056-b400-cfad8d63685b", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618920394, "uuid": "7be3a1bd-0e15-4176-8b34-860169a25347", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618920394, "uuid": "c511e06b-6a1b-4770-98a9-2d87709babc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920394, "uuid": "5298164a-3c5a-4b0b-ac20-8ea76e5d9de2", "value": "22863ee385a1cba0d455792fec3c1af61b61eecb3e35b4b2fd68b3fccdef8b4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a14589e-a204-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618942433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942433, "uuid": "c4ba430c-54ec-4f35-a69a-12f134e6550d", "comment": "Malware payload (Dridex)", "value": "ad7db994a8939874bc65685d65f0133b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942433, "uuid": "1584a71e-52f4-44de-97bc-3d760c8aae1f", "comment": "Malware payload (Dridex)", "value": "22e303c617d2118895fe68c73d99d21c1a8c1285bb01b0c6459b2e3d75cb9bee", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942433, "uuid": "bb5643fd-6313-4246-8721-fca910dca68f", "comment": "Malware payload (Dridex)", "value": "b8f5cee865aea72e9522bbfd638b8b869550d5c6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942433, "uuid": "e055fa71-1787-489a-936f-4f4c98ea06c3", "comment": "Malware payload (Dridex)", "value": "84e7815404ecb1a3ab5c80effa4cdf6f386b5ba4b47b02cbad2a1caf05da11f00ff7415d72cd155c5739426cfdd46555", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942433, "uuid": "165f1532-3f4f-4f55-848a-fd0f9932d53d", "value": "04F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942433, "uuid": "554eba9f-f2cc-4ea6-bf5b-288368f9aab5", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942433, "uuid": "5dac61bd-b1be-41d3-88c8-8cbbf82f651a", "value": "3072:KwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:KwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618942433, "uuid": "3a78e2af-4bf5-4666-a86c-ec7e7b57e587", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618942433, "uuid": "a1218fb0-7db9-4edf-b8c5-f3828204d955", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942433, "uuid": "44b9f3e6-6eb9-4dfd-a114-9a7293f03897", "value": "22e303c617d2118895fe68c73d99d21c1a8c1285bb01b0c6459b2e3d75cb9bee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba00abf7-a20e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618946969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946969, "uuid": "1e6fd749-7058-4e7f-9ef2-7f99f9aba3b5", "comment": "Malware payload (Dridex)", "value": "338d6a4ed02aada5509e71e10eb2f2a6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946969, "uuid": "a5deacc7-322f-4c00-9c62-a0044c8f37f2", "comment": "Malware payload (Dridex)", "value": "22f28c9f517c1df69da59299fde42f206f58a528b7b22ba95ed5286cfcbca56c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946969, "uuid": "fffed25e-308a-459a-97a9-ac080b509744", "comment": "Malware payload (Dridex)", "value": "3507bd0baee365cee5791d2f92fb32a5ba51cbec", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946969, "uuid": "b3be3ba0-b952-48b3-970b-3a78f6bc5a83", "comment": "Malware payload (Dridex)", "value": "9d2c2547e36fd0eb6ec1b66b36e14b278439b08e44fb25131991d1d4b8bf62b6aaea8e2c276f7e4392ba8812efaf8c3b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946969, "uuid": "0306d309-c153-470b-b43d-99f1787d15dc", "value": "57F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946969, "uuid": "a4009c61-49b2-446f-8f8a-ee2955d06685", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946969, "uuid": "ebf410b1-e558-4ce4-8d60-d8be6cfafd3b", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618946969, "uuid": "efb39501-b70e-4d11-be1a-f4dca781e9d4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618946969, "uuid": "3f2d7f76-6f38-4493-9ba9-836fafa2eddf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946969, "uuid": "1a0acb1b-9aa3-41e7-a2c5-69c1d5874da4", "value": "22f28c9f517c1df69da59299fde42f206f58a528b7b22ba95ed5286cfcbca56c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af49095d-a1fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618939650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939650, "uuid": "13410cf1-4db5-4e0f-ba9b-e6e42e8538c3", "comment": "Malware payload (Dridex)", "value": "aff320206c633a6fe9fa4ffd0ba0b16e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939650, "uuid": "b5ff2890-99d5-4c3f-88bb-cd063c774068", "comment": "Malware payload (Dridex)", "value": "230036b7a26221bd8d5b3dc2cf10ce4d9c9ea0cb7a44bb82a236380808cb08f0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939650, "uuid": "47bfb1be-6b1b-4692-8a32-2c6baaf4ac37", "comment": "Malware payload (Dridex)", "value": "3d56b966d1412cfa9e0c72d0bf481757bb76dd23", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939650, "uuid": "bbf0382e-d559-4378-a3f6-1a4fee3a5ca7", "comment": "Malware payload (Dridex)", "value": "d0443a8c0fcae03bb0396b34137e4690d91b4643b15a925a65ea513dda2f8e374838084b4c350a1da05ed0c2cb8182a3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939650, "uuid": "771c1a44-9121-4650-8345-bd4aa8ba03ca", "value": "0DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939650, "uuid": "407ce0e7-764f-4d9a-a27f-fc8a45ef31f7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939650, "uuid": "4ccade7e-3a9e-4be2-a7ab-c908e98722f9", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618939650, "uuid": "79ae3eaf-a435-44d1-8af1-5732697e2578", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618939650, "uuid": "5fe7f85e-47de-47b6-97f8-a979965f8a4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939650, "uuid": "43f3be85-dab6-423a-ac0f-69442c9523ba", "value": "230036b7a26221bd8d5b3dc2cf10ce4d9c9ea0cb7a44bb82a236380808cb08f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4f9adbf-a16e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618878268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618878268, "uuid": "87cc5afd-ad7a-4723-b61d-626eaa6bbec7", "comment": "Malware payload (Dridex)", "value": "0cb820b04e9632fc6dcac1401dad7f7f", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618878268, "uuid": "43490c4e-3a66-4f71-b12d-d95de3f665c6", "comment": "Malware payload (Dridex)", "value": "231082d52d292a8bd0d1edcf77ca2c1491abed1a446830d748b30fcb535df58c", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618878268, "uuid": "1bf4de89-54b1-408a-b835-9bf8a133210f", "comment": "Malware payload (Dridex)", "value": "db8a8f65f5f2f314a2dbbdbff5294869acb457b1", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618878268, "uuid": "5a5124d3-db8e-496d-bb4a-787a85652c99", "comment": "Malware payload (Dridex)", "value": "82bee35cf4ed987f6245513c028a1ce18def2d152c555a24625bac772dd0914f6cc1aef8f2423fbca05d4a750da40821", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618878268, "uuid": "e5efab0a-3c97-4c71-90b9-03da50174b33", "value": "49F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618878268, "uuid": "6fcfca82-836e-448c-8b2b-d6863a8d30f2", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618878268, "uuid": "46419a7f-1904-42d9-973e-83aaa252d58c", "value": "3072:wWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:w42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618878268, "uuid": "227069a2-f7fe-4d27-bba8-770aaca4a00c", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618878268, "uuid": "31cce07e-b9de-4f42-a6f4-d0a989b08dce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618878268, "uuid": "e85eb83d-c457-467a-960b-06243ab4958c", "value": "231082d52d292a8bd0d1edcf77ca2c1491abed1a446830d748b30fcb535df58c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b98f62c7-a1fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618939667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939667, "uuid": "f2811707-292f-4095-aa54-164e59be240e", "comment": "Malware payload (Dridex)", "value": "cae3eebbc5213609c853114e80547531", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939667, "uuid": "132b1eaa-4e1e-4d82-88f7-2b3d75ae518e", "comment": "Malware payload (Dridex)", "value": "2318546ccc0e5c7ae77378ea6e46e10953ffbe0c2048ac1f4a4fb59181108248", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939667, "uuid": "a5338e43-ff28-4a7a-aac6-d19b51044b0e", "comment": "Malware payload (Dridex)", "value": "083f193205fe56b680b2cb90c2b48bcba30e24db", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939667, "uuid": "f4da5077-3242-41d8-b664-b84d1b6a691f", "comment": "Malware payload (Dridex)", "value": "3b9ea347dd837cc0a120c9585e5990d0cac870b70d970f86d1a6874e5c137d09827ece6c2c0b2a693512fc81bc511881", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939667, "uuid": "b2534d90-0c9c-4637-9303-23f0812fcdc2", "value": "B9F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939667, "uuid": "261106aa-23c0-495f-a4ac-eff9a019172f", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939667, "uuid": "d30c3292-48cb-4620-bcc1-d40681b80b50", "value": "3072:SwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:SwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618939667, "uuid": "d6543c59-706e-4d45-b8ba-b88221e46694", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618939667, "uuid": "b4fdcf55-dd17-4b6c-bd65-7184cee59c1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939667, "uuid": "a72c15fb-8914-4305-8b60-69bd0bb7667c", "value": "2318546ccc0e5c7ae77378ea6e46e10953ffbe0c2048ac1f4a4fb59181108248", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7c8c55-a20b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618945610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945610, "uuid": "6a85eef6-9f3f-49e3-bd79-7108ce4e094c", "comment": "Malware payload (Dridex)", "value": "7a1e0256d7377de52db97b3d0d7588c0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945610, "uuid": "d6494524-87aa-4830-8b07-43c8bff224d7", "comment": "Malware payload (Dridex)", "value": "23f6957105509f97fbbbe47ebe0b9696cef1c18712c1f04ad8385ed2288a9b1b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945610, "uuid": "858bf5e9-e20e-46c2-a196-18cfd56f78a1", "comment": "Malware payload (Dridex)", "value": "a294cfee37d2008423ae637807156f3e9a1d7459", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945610, "uuid": "f3b4266a-dc41-4217-b534-1aca91898455", "comment": "Malware payload (Dridex)", "value": "a304a37c2fd9dc2fbb933f3402fb134a7966b04e440c54914c29d6c9285b026892f986ddd1657e2aafcf88230dcb1d31", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945610, "uuid": "c9b8a91b-1bc2-4f4e-bb6e-c77b6e92cd98", "value": "8DF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945610, "uuid": "c5c96a1d-704c-4f7c-9aed-13d989e2d20f", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945610, "uuid": "04766dd9-07e0-41d8-8d7f-054c0236ca7d", "value": "3072:8wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:8wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618945610, "uuid": "43da9eec-e07c-4413-91cc-ea86c06bebc2", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618945610, "uuid": "56e79c02-2f86-4f05-9170-420dd499b4b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945610, "uuid": "e83f2a60-aeaf-423e-9416-73f3b333de26", "value": "23f6957105509f97fbbbe47ebe0b9696cef1c18712c1f04ad8385ed2288a9b1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fdad494-a206-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618943436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943436, "uuid": "12921e6f-8498-40de-a27f-53af26c14848", "comment": "Malware payload (Dridex)", "value": "245bbfff50a215ff3deb9643de1e32ca", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943436, "uuid": "5e96aed6-4b0a-456d-acee-99f09d3c1e8c", "comment": "Malware payload (Dridex)", "value": "2415b01bae74d300cb4a5ec13f9fed4e6e118f1e20a7625bfbb7870f2d1c9633", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943436, "uuid": "5630ffaf-a36a-46e5-a466-032a0a85e3af", "comment": "Malware payload (Dridex)", "value": "93374286847dba37e9d44703ac7876ae59ff969d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943436, "uuid": "c81b3d7c-c74b-4bba-b378-4c0e061632b3", "comment": "Malware payload (Dridex)", "value": "4c35a83a84173d04c4c0fc7f786be75c6d922081a5d2d5a4cd178cff8d689940ad693ed90c225ce35b2904797912af88", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943436, "uuid": "df3e9144-ec23-49a8-8abd-c044b39f1530", "value": "0DF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943436, "uuid": "22aa982f-0e77-41fa-89d1-8123018c0fab", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943436, "uuid": "a4ddf98f-68c7-45df-8865-49855bb98c75", "value": "3072:ywZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:ywZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618943436, "uuid": "997c0c53-ede3-4fb8-93c7-2d68709a492e", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618943436, "uuid": "67f377a9-aba9-4f46-8b2f-2b7f83928485", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943436, "uuid": "2b01c838-22d7-4dcc-93f3-34bd426cc6ad", "value": "2415b01bae74d300cb4a5ec13f9fed4e6e118f1e20a7625bfbb7870f2d1c9633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d7f00bb-a22d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618960048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960048, "uuid": "248f67fc-137f-4872-800d-6106a8a21af4", "comment": "Malware payload", "value": "999ecb5e077441bc5ec479d7e2393374", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960048, "uuid": "0749e502-2031-4fc2-be84-f21b92df4230", "comment": "Malware payload", "value": "24275abaf7f6823848ff408cdd0d39edad3939dd5cc813c33843e53742ac35cc", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960048, "uuid": "a06c696a-66c8-4858-a13e-895429498005", "comment": "Malware payload", "value": "d46651f977e729f899ddf1ff745a8b42f54cc41c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960048, "uuid": "90e4147c-c873-49a4-98ff-8af963eb3f8f", "comment": "Malware payload", "value": "7794d7820930bad64f9559a7358f84f37612d8d0b21f0be9ed7d2e376077d43c60533d5eae1948f982891024d54a9914", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960048, "uuid": "de2543bd-21f3-4627-a643-3711eb27f798", "value": "4AF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960048, "uuid": "a9a319ec-58c8-42a4-a1de-047274eb1313", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960048, "uuid": "e0d1cec0-6ced-4d25-a3b3-9ad302539bea", "value": "3072:RwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:RwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618960048, "uuid": "40fd75cd-71a0-4226-91ba-7dd7abc698c2", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618960048, "uuid": "7d35be03-8b47-4423-aef8-d8e9968acdf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960048, "uuid": "81b9cc67-4f9f-4f58-bd21-36832147c01a", "value": "24275abaf7f6823848ff408cdd0d39edad3939dd5cc813c33843e53742ac35cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987eec3d-a21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618953785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953785, "uuid": "dce35486-fb88-49b6-a034-22be7a0f67df", "comment": "Malware payload (Dridex)", "value": "48f8f946099243fcde8f3005488fd95c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953785, "uuid": "c3d47626-8ea3-447f-8e46-534d87bb70fc", "comment": "Malware payload (Dridex)", "value": "2437348853efaaacea6079790482a611d0ca8d0616ff921fa7c91c8abf7939dd", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953785, "uuid": "6d8e17a1-7cf6-4f10-99ad-44b935f46cf7", "comment": "Malware payload (Dridex)", "value": "9f3ffa2e9b5617c77210aa7bbcc3ba2e330ce512", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953785, "uuid": "426a9e95-17c8-4c4b-a742-8fc02c880acb", "comment": "Malware payload (Dridex)", "value": "4369dc38b277b19b917e418de30489faeb8301aea4bda3af72c380a02e75289023d6a28ca50064f85e4d43461b3d9cd3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953785, "uuid": "9d7cce1d-adfa-4f87-a314-e22e9cff0611", "value": "67F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953785, "uuid": "cf4bdbac-d6eb-49c5-8f27-134b88896e09", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953785, "uuid": "4adbc77c-5a33-447d-8a2e-a9c475708290", "value": "3072:swZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:swZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618953785, "uuid": "5173eb6d-7800-402f-8ef8-ce300ea8ce6a", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618953785, "uuid": "989801eb-97e4-49fd-8705-4104b8500bf7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953785, "uuid": "0d460c2e-7e84-4999-a9ca-f0be4624eabc", "value": "2437348853efaaacea6079790482a611d0ca8d0616ff921fa7c91c8abf7939dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a14c21-a1a5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618901914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618901914, "uuid": "ed207006-8f5f-46cb-9614-5c2496d04f22", "comment": "Malware payload (Dridex)", "value": "0a93c9c9852381da57bc7935561be31d", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618901914, "uuid": "80e35873-c806-4d1e-8b97-7c2b01c606ca", "comment": "Malware payload (Dridex)", "value": "24405d96953d80b9d78663a072da7a1412ff6c1eaa77772bc3de6320ea668d3e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618901914, "uuid": "84e28e97-7416-4dca-8667-02c5c8a0d6eb", "comment": "Malware payload (Dridex)", "value": "0eca358369cbe80ee2105bb1d077bf6fb2871873", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618901914, "uuid": "c91c9fe3-2e6f-4107-a3ca-551ced96da50", "comment": "Malware payload (Dridex)", "value": "a43c236e0eb9a7c4301c4b11b2480c2e22ccd637fc7557d2c1dcb9ab9c4326787af260e50d2b7b8c090cb215cb6b9f93", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618901914, "uuid": "428be3f7-e63b-4331-a1cf-5d9a2744a3cf", "value": "41F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618901914, "uuid": "3a8fd378-4f08-43b3-af88-2888b2dfa394", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618901914, "uuid": "242b57f9-fe57-4134-807a-5041d102b77e", "value": "3072:Alpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Alo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618901914, "uuid": "23ffcb27-38cc-4a43-b756-2f4a6b8765b3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618901914, "uuid": "931ae9fb-57b3-485d-af8e-56afe57b9207", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618901914, "uuid": "aa6b85c8-ea0f-4b5a-bbd8-bc2307932134", "value": "24405d96953d80b9d78663a072da7a1412ff6c1eaa77772bc3de6320ea668d3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d43cc408-a1b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1618907929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618907929, "uuid": "1a11babd-88c8-4bd3-8712-bbd97db805df", "comment": "Malware payload (Gozi)", "value": "e4342f039cddb5f41f8e691a0b815667", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618907929, "uuid": "11523f5c-7b95-4d94-83c3-4d21234dd29c", "comment": "Malware payload (Gozi)", "value": "2473699a6bdc08eacb6b71554dfe59836524402f8bacb5da2617c321a9551421", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618907929, "uuid": "2cac8425-16e8-4328-b997-0fde59b044b5", "comment": "Malware payload (Gozi)", "value": "40247e1a8222fb1ca435b60c3925f04c485ce8b0", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618907929, "uuid": "2cdd4997-8706-4bd6-981b-ee99b7bef74b", "comment": "Malware payload (Gozi)", "value": "a1527403591c4f814200c756eab39f0e91c06ba75e00777bd1b5ec3753a2a161c43921b160ff747d3407cef6975d5f9c", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618907929, "uuid": "916ba87c-08fd-497e-8537-7c57675be19b", "value": "38244A6AA3E40695E9BBC6B5C952D66BE7F334052B14D70F03B0CAA46F17722F52C312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618907929, "uuid": "b60a5e6a-4145-4970-b7f2-9fc71adc217d", "value": "6144:xECFFxiQ6LX9BHM2b2eaIx3hzokW5IDB:xTxiQ6LjM2b2tcpok3DB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618907929, "uuid": "1fb8e3c4-0f3f-4880-88a3-b6ded6feab14", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618907929, "uuid": "8f8a9e2a-1973-4e86-ac39-1aa89abb28b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618907929, "uuid": "ef436eb2-cca4-4cf7-be04-38043bea5aab", "value": "b4f0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eccee527-a22a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618959081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959081, "uuid": "6b257760-fb3b-4146-baf1-3c29b5f56ced", "comment": "Malware payload", "value": "8dbc5a4ef2c8d3ceb88bc0f38b07edfd", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959081, "uuid": "030e99bf-fbc6-416f-a53a-6fbb52bd6a08", "comment": "Malware payload", "value": "247a96d62345434e3036a39a31d5587202ed06e1fdb3cad05dc2a452b86e639d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959081, "uuid": "6879abfc-84a5-462d-9e4e-9de6f9d46cca", "comment": "Malware payload", "value": "f728c3ceaaaccfbef2dc3e83b88c1058e2a3c5d2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959081, "uuid": "008310ca-99c1-4a23-aab0-1a3f69852821", "comment": "Malware payload", "value": "1764b44159d017fc7d26f72fd9bc7e008da37c20a0729f12ee3f1332e55be497f65f693de6e6472ee13430ac9a5553a2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959081, "uuid": "cfac0538-f713-46bb-bc5d-1a88e8fef5e2", "value": "20F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959081, "uuid": "551d6ebf-326f-4c80-ad1c-10865b3fd8c4", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959081, "uuid": "3cd62782-7d95-45c8-be18-f74a89a29162", "value": "3072:kwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:kwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618959081, "uuid": "286ffe87-9d50-40d1-a372-c30d9cd4391b", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618959081, "uuid": "94562ab2-d742-4f06-b3c3-703821638eaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959081, "uuid": "f262470b-e0f2-45ca-8bf8-644b67b8d27f", "value": "247a96d62345434e3036a39a31d5587202ed06e1fdb3cad05dc2a452b86e639d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c320af5-a1cd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1618918760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918760, "uuid": "9964d786-434c-487b-8e3d-2736bfaf95d8", "comment": "Malware payload (Vjw0rm)", "value": "222e7ad19fb35b7108429b6040c3bff6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918760, "uuid": "af11e497-97f8-43e7-9f24-e69ab4093692", "comment": "Malware payload (Vjw0rm)", "value": "24819fecd0dbc69d5f646ca085ac76ddd5229f1762d8bb7938c1244e880e075a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918760, "uuid": "c8be8dc1-292a-451f-960d-00528f9a30db", "comment": "Malware payload (Vjw0rm)", "value": "a38b37964a19cb6fdcfd5110fb415f8d1ed943b5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918760, "uuid": "18755343-1ff8-4c84-99fc-0a26e7509961", "comment": "Malware payload (Vjw0rm)", "value": "1dfc9a592c512dd5f4378dc11935650dca1b15ec4a3d8a66acf7c493229b3c84695cc06a1a1efcc5c9e21371d2e89554", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918760, "uuid": "6089bb88-4f18-4ee2-adb5-f802fb7e2bfa", "value": "DED23868242CA391951C46F1235E8BCFA029CF0C5CA431DC557C51DDAA793BE7BC2BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918760, "uuid": "b4f10369-ff3f-4f6f-8782-a77899c3d2a8", "value": "384:Brs32WxyupT91RjwAqvA1m0jV+feOlTJrwY7+bFNS51kJa2eeujA2fnVC5m5Uvgb:BrrWxyupdJq41GuZ3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618918760, "uuid": "5c7ae142-06d5-40e2-9859-6f466541ab0a", "value": 30550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618918760, "uuid": "bdb40ff4-5b4e-4104-91e9-2f025cc40fd4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918760, "uuid": "3028e651-17a4-49a2-94d0-f819c4932d70", "value": "ID88910662802.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d836ba5-a215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618949740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949740, "uuid": "719f229b-3762-46ea-b831-03c8f083a40f", "comment": "Malware payload (Dridex)", "value": "63b350caa6bde053821ec1a40d168a84", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949740, "uuid": "75e5472d-30d7-42d1-acfc-f9f1a1f8c8fc", "comment": "Malware payload (Dridex)", "value": "248297bac173bf5b2ede9dcd2bcc4f23e11eda59b3a283c8786118e39de6b437", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949740, "uuid": "517f2dbd-7f1a-47ba-b48d-2fae08a15263", "comment": "Malware payload (Dridex)", "value": "0848a70c38c0f50cb4925318df829510b5f96946", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949740, "uuid": "a1c0ba90-975d-4a67-a924-9961ae835f5c", "comment": "Malware payload (Dridex)", "value": "ed16e78336a2f1f28b4f59d807749041ff22a00962fd42d1944ca6b9fa4575ccc7e741d9ee9c506b48d22bf4b8f8e3b2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949740, "uuid": "aac9aad6-1f3c-4f01-9b3a-dc1bda3da06c", "value": "30F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949740, "uuid": "6a28421d-a1d9-47b3-96d5-e8ca2a5d0fdf", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949740, "uuid": "caee649a-b56e-4cc1-9676-48de91c5f604", "value": "3072:dwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:dwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618949740, "uuid": "7bb5faee-fdac-44c6-8209-b6ee1c315074", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618949740, "uuid": "89cf432a-ef28-454f-88fa-7f6589d1627c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949740, "uuid": "a085d53b-2472-433c-937c-3112bc9cc2b5", "value": "248297bac173bf5b2ede9dcd2bcc4f23e11eda59b3a283c8786118e39de6b437", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e09b16-a21c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618952999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952999, "uuid": "b7b9dcfd-0bfb-4268-bbc1-be326453582d", "comment": "Malware payload (Dridex)", "value": "7e265ef9dac00fe2e3d9354643fc2b1d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952999, "uuid": "88b57bf0-f1f0-4474-a9ea-f9801de5cfed", "comment": "Malware payload (Dridex)", "value": "248c24bcd0e7658cb983d6d9aa6b4123c065f7c474d7d24029a7742f4f7620c4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952999, "uuid": "ea647fd0-28fc-4ad8-be26-6ef50a0a9ad5", "comment": "Malware payload (Dridex)", "value": "9d11653417e7652592c78d068378e45482620642", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952999, "uuid": "21ddbbed-c742-44e3-9c78-7c11c708c63f", "comment": "Malware payload (Dridex)", "value": "7758501c125f114539a5b76472963649916b2cbb2fd95e25d6773528b36922de4544eb9e8eeb1f598cf217d760da7b71", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952999, "uuid": "fd22809e-10aa-4ff5-9073-5ae1a2972e6b", "value": "86F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952999, "uuid": "209274f2-7a57-4d1a-a225-3fe487ac2866", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952999, "uuid": "5bdc5e01-551d-4b71-a3c9-fd136676ef0f", "value": "3072:SwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:SwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618952999, "uuid": "27cf26ed-a965-49dc-be6c-0cf0903d86bb", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618952999, "uuid": "69c9ae93-0171-457d-b499-6da3fae0e58a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952999, "uuid": "626159a4-5354-4824-8946-0684d1784bba", "value": "248c24bcd0e7658cb983d6d9aa6b4123c065f7c474d7d24029a7742f4f7620c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886dd825-a1f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618935290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618935290, "uuid": "607052c2-5869-457a-bb2d-deb67d306816", "comment": "Malware payload (Dridex)", "value": "f566a547927fbc9184ac09b9294e99f4", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618935290, "uuid": "11bf008b-4cf7-49fa-bcf2-ab64ca93240d", "comment": "Malware payload (Dridex)", "value": "24d83d638a336fd28fe893a5dd2907a2a2735f369c8975ca0d5310827391bf61", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618935290, "uuid": "a0c4ac87-11d2-4d09-8fe8-3507d5748d37", "comment": "Malware payload (Dridex)", "value": "732131d1ec1a03bec6cc83e0105ee60860ec93e2", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618935290, "uuid": "ebc1d7b6-c6a5-49a4-ac6e-7ccbe222b102", "comment": "Malware payload (Dridex)", "value": "7d0e84d4c048e3fdb57fdfeb7cbd5c28fc2f3db86b6d6cf1a48a080b62b76589292f66b764f51503aa518fb5dcc25008", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618935290, "uuid": "db3f6f37-d33f-4479-81b1-dd1005735469", "value": "AFF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618935290, "uuid": "0dfd5cbe-6b4f-40bb-b856-6de637878172", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618935290, "uuid": "c5c45c7f-346b-4961-9b32-7027084be802", "value": "3072:liFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:OeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618935290, "uuid": "afb83399-bc49-47b8-a573-4d4efe3d7561", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618935290, "uuid": "be7ff4e8-98c7-42be-8677-e7d7d3cd323e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618935290, "uuid": "33208e82-ad0c-4fb6-98ba-568a93e3c2eb", "value": "24d83d638a336fd28fe893a5dd2907a2a2735f369c8975ca0d5310827391bf61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a8d0a2-a19b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618897595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897595, "uuid": "5ea07581-23bf-4714-b367-f34d56881444", "comment": "Malware payload (Dridex)", "value": "bc278195d206db2d3f03e216e38ee66a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897595, "uuid": "bcbbe501-71ad-4ab1-a7d6-0b1e60bb69df", "comment": "Malware payload (Dridex)", "value": "24d9c4233f619a8383d5e89c41226d2c4f458b26a1a28068675febb6e1c1344c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897595, "uuid": "cee66e24-f599-4b70-83e9-09fad93279f7", "comment": "Malware payload (Dridex)", "value": "50e9500161ecda544e9c0742e443f8f228bcd02a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897595, "uuid": "f4f9fe41-34d7-4b8c-ad70-34f54ad7a3a1", "comment": "Malware payload (Dridex)", "value": "04642a9a8621e31117199b32f3e182fe8f550561769002018823229470c3bf1f00f5088898d75f0ffaf0e79d5c56db75", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897595, "uuid": "fe4253c0-1420-486f-826c-4049f611a919", "value": "33F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897595, "uuid": "354c8212-4af5-4e68-9f3b-828aedf8a045", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897595, "uuid": "cef0edc9-04e2-421c-866d-3d713ed5f5d0", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618897595, "uuid": "f241e4c1-dda0-4ac9-823b-ce7845648743", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618897595, "uuid": "1473f8ff-81e4-44bd-8941-c0f47037bce1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897595, "uuid": "9b007550-b8b9-4776-a339-1f68b2e0c6db", "value": "24d9c4233f619a8383d5e89c41226d2c4f458b26a1a28068675febb6e1c1344c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47663bc8-a1a4-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618901250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618901250, "uuid": "9635c67c-dc44-4a6a-b7c1-520cc6392f1f", "comment": "Malware payload (SnakeKeylogger)", "value": "96c1ec86c11669a6d924c529a79cc54d", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618901250, "uuid": "fc215ff3-28ed-45e5-a3d4-7835dc4b5579", "comment": "Malware payload (SnakeKeylogger)", "value": "24ef0a7b7382be06f4a9a228a0aae95170b5789186655035817f81b4210ca7cc", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618901250, "uuid": "a370d2f8-2a2c-4f10-9149-2584c9f56bc9", "comment": "Malware payload (SnakeKeylogger)", "value": "3dc8112095b2d394f3537ebbc0714bc95570f9da", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618901250, "uuid": "37d21591-3b60-4277-9f0b-78da43be7beb", "comment": "Malware payload (SnakeKeylogger)", "value": "431236f1e8b9bcd9b94d2dff0a9187c438854f02d8f0fa46d89d35094a9df0c301a1bca289de78053790ef3db2cc1a17", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618901250, "uuid": "699e6fca-0420-4c09-b421-be0849de7502", "value": "C535DF217FD5DF54D2BA4B7889B09250A3F9BC118A5BC70AFE6136DC8E31FC46E46242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618901250, "uuid": "da08640e-0649-44a7-ab32-9b3a21e54e12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618901250, "uuid": "9ce9dad5-40e4-43a2-98cd-f10cf385f2d9", "value": "24576:uaHROBOobXURRRRRim2LFJVTY8AqOUYTlC5sX/:uaHE3bXURRRRRv2LFJVTYjqzYpCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618901250, "uuid": "c04b020a-4c98-4493-b514-755d27a6593d", "value": 1070592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618901250, "uuid": "a0c49c87-34a5-4326-967e-74e089c7655b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618901250, "uuid": "a15464bf-c9f4-442b-b766-81396aa507c1", "value": "RFQOIL FIELD MARINE OFFSHORE SERVICESFSF62BOPCOSO12A & SO15E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63051036-a21c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618952836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952836, "uuid": "730f2f5f-f968-4541-ab9a-71da3b893f6d", "comment": "Malware payload (Dridex)", "value": "58dda467e878e93a83e9194f00b22141", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952836, "uuid": "7b6cde13-8650-4ee0-8747-353966a540f1", "comment": "Malware payload (Dridex)", "value": "2526f66cc57aeb705d3f7422b67a1a2a66e203ac93bd8c09bca95728607a3efe", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952836, "uuid": "cb752f79-6ee8-44de-90f6-ab534f6bd5d4", "comment": "Malware payload (Dridex)", "value": "dfc5e682257d0f0c6d76d7346015263fb0e7d484", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952836, "uuid": "fe08c8e0-f781-43ee-a59d-8caa2fd3e175", "comment": "Malware payload (Dridex)", "value": "d4f6815a69095e6f940592435930751fb131f0d71e6eb09ec7958f9bff049dc6f1dd7ca5f0fda7dbcefbbf27f1fdc7ff", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952836, "uuid": "6b052cf3-1eca-458b-9316-4fae7aeb6d9e", "value": "5DF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952836, "uuid": "331f0b6f-c286-407c-aadc-efd350e0e4b7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952836, "uuid": "78fb0696-9776-462b-99ce-8de6baf20c16", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618952836, "uuid": "81cdb1e1-c8c9-4693-a614-1cf1b09727f1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618952836, "uuid": "761b4ae5-b085-4dad-91f8-631353c44d8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952836, "uuid": "dd8f584a-03ff-45ef-ab30-26b39f48f80c", "value": "2526f66cc57aeb705d3f7422b67a1a2a66e203ac93bd8c09bca95728607a3efe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4300bdd-a21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618953832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953832, "uuid": "313fc764-793e-4d60-8e5b-f27653b7edb1", "comment": "Malware payload (Dridex)", "value": "51a71a6720aa9383a1f43065ba9b2814", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953832, "uuid": "13b62d70-acc0-40c8-bebe-02d93cbf03f8", "comment": "Malware payload (Dridex)", "value": "2547fd83902daacb9e38edad6b34a42e441bed05eefdbc4f36220056d81063ef", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953832, "uuid": "9e23f427-b155-42b1-8487-c315dd91daef", "comment": "Malware payload (Dridex)", "value": "077792b1ed735151028f2c290df676856712632a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953832, "uuid": "a602fa66-2358-44ae-8d1d-d5efe7e9f021", "comment": "Malware payload (Dridex)", "value": "7cfed0e1fd822aba4903eaf7acefa9055b1be6d84cb523ad8febc8d8fbeef4ae410882a77f03cf8630db636928400e37", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953832, "uuid": "b9c0b49f-a374-412d-9867-9d5477421c20", "value": "EFF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953832, "uuid": "36b1c806-cff3-4132-9d4c-62eef56f427a", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953832, "uuid": "d1e9a5ad-84af-4426-8bcc-2ca8607dd33a", "value": "3072:WwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:WwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618953832, "uuid": "4c520186-ecb5-45eb-bf56-ff65323e9d31", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618953832, "uuid": "cf6090ce-fc83-4f02-80bd-bcabfabdf1e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953832, "uuid": "537744f8-a129-4342-ab4d-05a1de9c8b4c", "value": "2547fd83902daacb9e38edad6b34a42e441bed05eefdbc4f36220056d81063ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3208534-a207-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618944032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944032, "uuid": "163423fd-d7d7-407f-9692-39a3b457efc1", "comment": "Malware payload (Dridex)", "value": "acebae6e24ac817ba620c4d07645ad9a", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944032, "uuid": "3e40d634-cc8c-4523-bf58-8683b4b44bed", "comment": "Malware payload (Dridex)", "value": "2548dfdb441180ab59d17035a34155eb49c0a5910dc036e048c3d19adcf8b3b0", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944032, "uuid": "e6d35ddb-b80f-4e2b-9dc4-7e97212fc16e", "comment": "Malware payload (Dridex)", "value": "7218ddff1267036e176deebf4e97cee93346f9ed", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944032, "uuid": "8fbb6da9-81f4-4a57-966a-0c7324a283ed", "comment": "Malware payload (Dridex)", "value": "0001f17df0665eb1abee425b5a4462a211d1302c3d4168cc6a29443499e72cf35727c7968ee543be0bc82288a8a65dd4", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944032, "uuid": "f10c984f-231e-43bb-b3cd-551f5f0b945b", "value": "D0F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944032, "uuid": "aaddc55e-f1a9-4c14-8522-b4b9522ba231", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944032, "uuid": "23301be4-0c44-429c-adb8-19d0e2720a0c", "value": "3072:xlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:xlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618944032, "uuid": "982a32e2-30a2-40e9-b16d-af8c85952216", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618944032, "uuid": "6ecb5df3-87c0-4063-8fc3-ea2f3ea418b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944032, "uuid": "e9cb9353-e68a-4390-be83-c07a23e3c36e", "value": "2548dfdb441180ab59d17035a34155eb49c0a5910dc036e048c3d19adcf8b3b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5abd1717-a1ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618932636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618932636, "uuid": "c8428dc6-c011-40ff-b0d1-d282b678502a", "comment": "Malware payload (Dridex)", "value": "745d67c63a425b431c226bfd5a09bf3a", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618932636, "uuid": "4e88f005-6b52-40a4-8969-9dcccce26a3b", "comment": "Malware payload (Dridex)", "value": "255bff3a44d7431b9233748fe2c2f75bad2ce626a7d107330f40cc970ff9ade6", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618932636, "uuid": "23fb76ac-fd87-4ece-8c18-29d4f9e4bd44", "comment": "Malware payload (Dridex)", "value": "60dfe7f802bfbf92bbe26fca0dce88bd75e5578f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618932636, "uuid": "4b5ad354-ca5c-4576-8d0a-d36656d24bf6", "comment": "Malware payload (Dridex)", "value": "860f4e6a3ad1ceb77ca95cec93b52c2f430bca6c83cb08790813bd79daa29c7360f114ae5d9ec9dac69f28d7f272040b", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618932636, "uuid": "d90cb598-8883-440b-96c3-5a5b8b000d7a", "value": "F7F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618932636, "uuid": "a28ecf5f-fcb2-440f-87ae-b21250353b00", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618932636, "uuid": "63c6c40f-f430-4746-9894-2da408a7c8bd", "value": "3072:Klpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Klo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618932636, "uuid": "a0ff4a94-a257-41b3-b249-e5398bdd0b17", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618932636, "uuid": "03555087-e989-4a0e-b74c-2ae9b0526d17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618932636, "uuid": "d9a0b7cd-0332-4098-8f8b-53e85bc3226e", "value": "255bff3a44d7431b9233748fe2c2f75bad2ce626a7d107330f40cc970ff9ade6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0676c40e-a218-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618950963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950963, "uuid": "b977fa23-c32f-4657-a701-51a4a4f129c7", "comment": "Malware payload (Dridex)", "value": "6515bca5334b59204e7225c943141be2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950963, "uuid": "3839fd4e-af41-46e0-b04b-c9bd874e135a", "comment": "Malware payload (Dridex)", "value": "256c30978cda407fd726bbe0f58223c93b97eaec8a357440d454263162eef251", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950963, "uuid": "47a188c4-0d0d-42cd-a627-573ce0ac8532", "comment": "Malware payload (Dridex)", "value": "ad63f5d9b9c51c8e599e7c7f43c4bd57d34aa975", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950963, "uuid": "3011cdef-a358-4eec-bb79-b8bce723a767", "comment": "Malware payload (Dridex)", "value": "d67a10e9b974df8c56ca1246ce92d7943052e95650b21b8934b5ba9dea262c2e60230e83aef866ae7b55676e84921967", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950963, "uuid": "6bbbb0a8-5976-401a-a14e-074709a73262", "value": "CEF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950963, "uuid": "25fd537a-5bb6-4391-aa14-42b225295377", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950963, "uuid": "e626711a-efd2-4671-92f3-96788c071763", "value": "3072:GwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:GwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618950963, "uuid": "09119a77-064a-497e-8bf3-bca69d049bda", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618950963, "uuid": "45fa3c09-2c80-45a5-827e-059531fa0e6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950963, "uuid": "dfe7e847-cba1-4160-b480-503bc86d9642", "value": "256c30978cda407fd726bbe0f58223c93b97eaec8a357440d454263162eef251", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32fe9671-a233-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618962634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962634, "uuid": "9a79c011-36a5-4010-847b-cd7154125e6d", "comment": "Malware payload", "value": "7449441f84e10ee65c726e6f406c1993", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962634, "uuid": "36f70e54-0bc2-4755-8de3-d8a2a6f950e5", "comment": "Malware payload", "value": "259687abb4003839ff0797571f8291a1eeb38895aab41bb12b529506d2cdca0d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962634, "uuid": "474e88d6-aa58-4909-983b-74b31ebcdcde", "comment": "Malware payload", "value": "15ea0e5b9614a8fc9a3e1ca34c221786dd4a77cd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962634, "uuid": "b8456ba1-a696-4d47-b882-043949063d90", "comment": "Malware payload", "value": "a55bad0851306942eaf13eb82e329dfedc919f42f3e6c958fa60511523f45f648b703e7d95045114732b1a827c642e56", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962634, "uuid": "187e1ae6-3dbf-4ba9-9f7a-04ef978ff22e", "value": "D9F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962634, "uuid": "3829a5cc-360b-4286-81f0-e0f265524b66", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962634, "uuid": "0de2b2a7-fd19-496d-bfd2-2bee7a6be18b", "value": "3072:9wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:9wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618962634, "uuid": "0031d8e4-ea00-42cb-b462-007cf5a94784", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618962634, "uuid": "e2999e7e-058d-4b29-bdb2-d7ebe4661bab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962634, "uuid": "f5a16bb0-4677-46c5-bdbc-dbf3cc0d9c8b", "value": "259687abb4003839ff0797571f8291a1eeb38895aab41bb12b529506d2cdca0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d6ead2-a1fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618939876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939876, "uuid": "2b29acd9-d7f6-4ad3-9b8c-dd3ad2eef6dc", "comment": "Malware payload (Dridex)", "value": "a5d268327bbe5a1e9294b7beba77e0be", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939876, "uuid": "b5305e44-60f0-459d-b8e3-4d9e12f49507", "comment": "Malware payload (Dridex)", "value": "25b9b7b044cffc5f766052784e201bbe3e8e08b0325ef9e2afacf2ba53559e55", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939876, "uuid": "f4b5f9c8-2001-4350-8ed0-d5eae65bfd38", "comment": "Malware payload (Dridex)", "value": "6ccca4e907154ba48ac83fb930d5a1f905aedabb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939876, "uuid": "bf6b4fd3-f310-42cc-a202-85c7e131e5cd", "comment": "Malware payload (Dridex)", "value": "9fa7452762c128852af08662f8afa2c2e1423606a0a13ed4d6bb4bf9d0572a40107065cfd5a0107f8d54b970aa958c19", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939876, "uuid": "654ac7c0-de6a-4dfc-916e-3966f9dedbcc", "value": "E5F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939876, "uuid": "aeecdaf6-7406-4ce6-8b5b-13d88300afec", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939876, "uuid": "388728f3-f3c5-4151-a58e-3c77ac64923d", "value": "3072:AwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:AwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618939876, "uuid": "014a079c-69fd-42d2-b85c-49dff499ce43", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618939876, "uuid": "ed8977f5-62cf-4981-b6ed-f07e2c3de5be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939876, "uuid": "cbc6706b-916a-4740-888d-4996583bb6d4", "value": "25b9b7b044cffc5f766052784e201bbe3e8e08b0325ef9e2afacf2ba53559e55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff8ead1-a21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618953744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953744, "uuid": "af6e87ed-782f-4737-adac-6f5b51a8dac4", "comment": "Malware payload (Dridex)", "value": "3a331ddd182441671c812c7498bbc1e1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953744, "uuid": "08aa3043-d246-4342-8254-d80c225cef43", "comment": "Malware payload (Dridex)", "value": "261b48f9077cef94e28f579f72167b8b414aa85627fb415ca0f2ab9b0f80a597", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953744, "uuid": "df634620-dc04-43bc-8e80-4c4ca13e1545", "comment": "Malware payload (Dridex)", "value": "6639fbd638371a4735ba05136aa4089ddaf57eac", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953744, "uuid": "49e738ca-6e1b-4ea7-a6db-9b1c3542cd35", "comment": "Malware payload (Dridex)", "value": "c4ed1c7a90b272815b98e8136cf75c61644cb92e3390673e952f7aeb1319c1379dc70be1c541fd8dc158068dc01f499e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953744, "uuid": "1edc9ced-a912-411e-9c68-27e55bd63625", "value": "96F3D088CBB3E4E6EFB3D37966F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953744, "uuid": "252600dd-29e6-44e6-a02e-3b9a923c1c77", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953744, "uuid": "ed136f62-0657-4fec-975b-3ed17486b8d8", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618953744, "uuid": "0ba1d047-e548-44c2-8437-dcf85d6f088f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618953744, "uuid": "46e8c61a-6886-428b-9b71-9a80fc9d818a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953744, "uuid": "1b8c6e3a-2ce5-4e24-8bf2-7241243ca73c", "value": "261b48f9077cef94e28f579f72167b8b414aa85627fb415ca0f2ab9b0f80a597", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6508f419-a234-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618963148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618963148, "uuid": "25283d9b-d290-4904-9ffd-8f64feccc18a", "comment": "Malware payload", "value": "ca44c3d20ac1658fe09f1ee3357601f9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618963148, "uuid": "08caaa77-d443-4154-867a-43e9ee3960cc", "comment": "Malware payload", "value": "264473e4e04d44b9d9c1d5d52ece734b5fb3e4946f670457066e39a7c2d41ef3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618963148, "uuid": "bf9d8866-cca6-4e03-b4c5-9260cc84b2f8", "comment": "Malware payload", "value": "85e514acb301bd28d5d564b3ed025817c6954893", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618963148, "uuid": "b59f969c-9051-4536-b047-682e39e848c6", "comment": "Malware payload", "value": "79d8348f12cbdf23eac1c9db3d1db601f5e8abfe304592cf7eb388bfd75969983b5bcd98796423742bf4a8b14d067a2a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618963148, "uuid": "41c31be3-73da-430b-bf66-f513362778d2", "value": "36F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618963148, "uuid": "ec67ef3f-cb4d-480c-b250-a75927115d55", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618963148, "uuid": "d34ff5fe-0bf2-4318-a71b-d2b7469254a3", "value": "3072:RwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:RwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618963148, "uuid": "3132b732-cb93-4173-89d9-8df6ea219c3b", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618963148, "uuid": "18b653c3-3054-48eb-982c-4acebbaf9fa8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618963148, "uuid": "32d4c374-36be-48aa-b4ec-c24d1e254a2f", "value": "264473e4e04d44b9d9c1d5d52ece734b5fb3e4946f670457066e39a7c2d41ef3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8040cdc0-a1a7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618902634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618902634, "uuid": "cb6b0877-9724-4788-a9cc-f4121db6f700", "comment": "Malware payload (Dridex)", "value": "0d380078fab41edced6a34cb721f79ba", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618902634, "uuid": "54e89cdf-b1d2-469d-8d9e-cd74d3759fa8", "comment": "Malware payload (Dridex)", "value": "26463002e14e937b1e1c0ce78a2b6c8f3b2f18a2ee4fde8a3331f58374a0db4a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618902634, "uuid": "11e98954-c7ac-41c6-82f7-614aa2126368", "comment": "Malware payload (Dridex)", "value": "87926cd26a75f2317a1a6de6e9b18cc0f1aad21b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618902634, "uuid": "913efaf5-7593-4600-ae55-4e7d867b2352", "comment": "Malware payload (Dridex)", "value": "db200c3273c911f75b319a958250d528baed7de36f59e6fd16a1551efaeb44a49d7396c1a2d14edba9c60fadaaf4c5f3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618902634, "uuid": "3cd69e93-e947-425e-a0fc-30a0a8c18240", "value": "5EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618902634, "uuid": "66cd7a10-cd17-4a9b-984f-fe8843fdbe4b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618902634, "uuid": "775a331f-c732-4f70-99f4-43e2c3be9032", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618902634, "uuid": "c2c9a633-8d9c-407a-a155-8860400a29d5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618902634, "uuid": "c81bcf07-6d8e-49ae-80a4-9a00e8bc843b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618902634, "uuid": "8c293458-f0ca-49d1-8c6d-342587078b81", "value": "26463002e14e937b1e1c0ce78a2b6c8f3b2f18a2ee4fde8a3331f58374a0db4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253e9245-a21a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618951874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951874, "uuid": "770f7370-9243-4d59-9567-d89637cf9e7c", "comment": "Malware payload (AgentTesla)", "value": "c36ad7f2af4301e441cc4a3145a83708", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951874, "uuid": "70043409-0289-4343-83bc-4ad8f7b9f372", "comment": "Malware payload (AgentTesla)", "value": "269c4d49f4199df590c3de0143d04944e646060c891e2e075c95d13e4c5699d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951874, "uuid": "88488e6d-6e4a-4cb7-9f25-8e2c128e57f1", "comment": "Malware payload (AgentTesla)", "value": "f53064308daaf5012ae26da7a2f18de34b4f23fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951874, "uuid": "049b63ea-5a58-479c-999b-1f8bcdbd41da", "comment": "Malware payload (AgentTesla)", "value": "757621b71339ca19a413e2e7fc715c9721214f736cb286ff8f67e476a3b437c37a783cf3b1b10806c160413dd0765ffc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951874, "uuid": "31a73173-acfa-4783-9c7b-c45080a0b9ef", "value": "D6C42387FA797B3742B065109A510B4B2DCBE203524EF64E9E052D7FE141ED0A37A3D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951874, "uuid": "e0834b46-47a7-4b52-9fd4-7b1242fa9077", "value": "12288:UMzGGJILQRJaOplh588XPFAVAMbTXfJB9OhZMnOEugCoPPfg:/JILQ/1fyAM/fysOEumA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618951874, "uuid": "74b70f0e-b95a-4c53-b7e5-69682b5c6942", "value": 552615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618951874, "uuid": "07ddf4b6-7cbf-44db-97e6-d86b661f055d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951874, "uuid": "5b005a93-91cc-432f-8d52-99b8c33621b6", "value": "SOA COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e521618-a21f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618954010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954010, "uuid": "d51d7f1c-1001-4368-9e2e-944e967bf4e6", "comment": "Malware payload (Dridex)", "value": "43e14f8db4f7fc51a552fb72d77c7562", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954010, "uuid": "4894ac75-5840-405b-8bd8-aba6681b9f5a", "comment": "Malware payload (Dridex)", "value": "2705bb19804953bf132010172b5687a1b6c08a9b5eaf68596980096e43e19789", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954010, "uuid": "5756d90f-e579-48aa-bbc8-4227b8f37f14", "comment": "Malware payload (Dridex)", "value": "b3b263ec9b69205114a9be5973dc57d2485337b6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954010, "uuid": "92102fd2-3c5d-4cd0-935a-1e2e8597fe59", "comment": "Malware payload (Dridex)", "value": "e8dfba5bfc7e51745b8404a6e7eb9b99e0273af7fcabfe29b33972d8c154343f895f026ab9ee074e77038fb6b61c9a58", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954010, "uuid": "f94f2404-040b-417a-9147-77a68d73c7e1", "value": "4AF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954010, "uuid": "bf67058f-297f-4289-87ef-38a03848d995", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954010, "uuid": "30c68403-7fee-47ea-9753-e8de5cf28eef", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618954010, "uuid": "86f2d051-abab-438a-8712-ac1595dfca41", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618954010, "uuid": "57592fba-4793-43cf-8211-7a1318d2910e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954010, "uuid": "8c4ff47a-a304-4a90-a40a-445d1ece5275", "value": "2705bb19804953bf132010172b5687a1b6c08a9b5eaf68596980096e43e19789", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6a1c21-a234-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618963029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618963029, "uuid": "2021996a-a79c-4381-95b3-9436656fb8c0", "comment": "Malware payload", "value": "4b030ca3aae7c508a9a0146c469deeec", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618963029, "uuid": "08c1e8fe-f0f8-4f4f-9bee-8d8c7d2ea809", "comment": "Malware payload", "value": "2735ef1e7369537df46881c9e8524d00d98d04b1c95bc324ff53a8a4783ea8a1", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618963029, "uuid": "a6b46f57-51b7-4b18-bfcb-5694d6a71927", "comment": "Malware payload", "value": "3245294400dc29d9b89fcfd3ce9515136279a133", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618963029, "uuid": "4e156d31-a1e8-4810-ba51-a6872a55b439", "comment": "Malware payload", "value": "b5cdafe197ef6404d790eeeae1f9e4c640313d0229f7f3d4a66d23f04a703d593b774bd0d40b12cef9072752e8a28868", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618963029, "uuid": "7f020123-9e21-4816-88a4-ddafccd1d812", "value": "42F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618963029, "uuid": "af54b5c9-42a8-469f-b2ba-e64bad957132", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618963029, "uuid": "1a111d16-5f07-485a-875b-bbc1ae3e792d", "value": "3072:SiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ReAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618963029, "uuid": "4acd6b44-31eb-4957-a507-97892c495914", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618963029, "uuid": "6d14cacc-73d8-4ea3-8a15-236de78c6fd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618963029, "uuid": "c7ef4b9e-56bf-40c8-a9be-175be6f2017d", "value": "2735ef1e7369537df46881c9e8524d00d98d04b1c95bc324ff53a8a4783ea8a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e22e2ed-a1ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618910845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618910845, "uuid": "90dba33f-98c0-47b4-bf95-ac5051c9ebd3", "comment": "Malware payload (Dridex)", "value": "e86179b3e29eefa4b301b4d7eb5ea067", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618910845, "uuid": "a25be770-9bff-4483-ba10-97bdb129d791", "comment": "Malware payload (Dridex)", "value": "2749a6c63d288661c5d77aaebb0b2753463c9adcfc4f929c140ce697f2db3692", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618910845, "uuid": "77915953-645b-48c4-a4dd-28aa52375340", "comment": "Malware payload (Dridex)", "value": "42575785b7d3d55b14b793210372399ddc4654c9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618910845, "uuid": "0c35aed2-982d-4551-8bd7-c4d0beb94809", "comment": "Malware payload (Dridex)", "value": "1cd05946f3c0062d14daeef027c33cc679252ba36e7f6e8fe456f308411975f897f63eb72641675947f46e26e2a49880", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618910845, "uuid": "7b70987f-1295-4f04-b59f-315db920454b", "value": "2BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618910845, "uuid": "118c7f9a-948f-46bf-99bb-c443432ab5ff", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618910845, "uuid": "5cda7fc1-b994-4485-a5b8-ed06c5f43cff", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618910845, "uuid": "506bf572-7267-43d2-9c03-3ed06b4b85fb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618910845, "uuid": "24d0d9c9-9472-4377-8239-2c877533458b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618910845, "uuid": "5322a324-516d-4da9-9230-162e69f15f79", "value": "2749a6c63d288661c5d77aaebb0b2753463c9adcfc4f929c140ce697f2db3692", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4e562b-a227-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618957635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957635, "uuid": "53e73de6-4ec3-4c03-99e2-d3893bdad31a", "comment": "Malware payload", "value": "aac4a697753fe206d65183ecbe3268d3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957635, "uuid": "39273d96-baf0-41b5-aae5-2688a6fbff78", "comment": "Malware payload", "value": "27ef8fe875a0cf98e3364631bf2b840b66e2b3a1260dd31a4eb0f0159261fb6e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957635, "uuid": "3371fd62-4569-42fb-b167-243c3c160a30", "comment": "Malware payload", "value": "6d231875adc67a270bfac875cbecc7b3fd2e5432", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957635, "uuid": "82f20d7f-37bf-4210-8e58-cd7939b4d9b0", "comment": "Malware payload", "value": "26ad1647882531159857471ca96126c0ab3237f24ad9d39b2643a76cffde233fce43a42bc857d9a1f9301ea262bd5760", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957635, "uuid": "8d8386dd-c1ab-460a-8ba0-ac6dfc8c5788", "value": "36F3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957635, "uuid": "ea975a4f-19e6-42ed-933c-1a09e4203c32", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957635, "uuid": "d079e6be-caf9-4175-81cc-7e87b6f47eea", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618957635, "uuid": "84d1fa82-ee4e-46bc-a6aa-4f227ef724e0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618957635, "uuid": "0deb78ee-d107-4222-b8d0-30f74f5876b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957635, "uuid": "f5d848c2-f06b-4514-b25d-bf21359702fc", "value": "27ef8fe875a0cf98e3364631bf2b840b66e2b3a1260dd31a4eb0f0159261fb6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ecd436b-a217-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618950762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950762, "uuid": "fea775ee-c67c-44dc-b148-d6f173562c59", "comment": "Malware payload (Dridex)", "value": "c6140daf9a773ca117e3c2726154f8e7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950762, "uuid": "b9b979e8-d3d0-4c1a-a734-5552a20b1391", "comment": "Malware payload (Dridex)", "value": "281be363ee6c8753e21746cd6109038ec537612969522b7464e623e2f203cff2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950762, "uuid": "ae3febce-7017-4d8e-bd51-7c8dc362763a", "comment": "Malware payload (Dridex)", "value": "dba0b2e8129dd9839000440f79e8f8069c47d1e8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950762, "uuid": "48899146-a2b3-4acc-94c9-30074a82cb51", "comment": "Malware payload (Dridex)", "value": "17ccef1e919e92d3eaf0537f9309aa73644f74963ef2d90e3c04473e18b2cdf66c1bda119b2df781c4eacc6700946342", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950762, "uuid": "f35ea988-d53d-4d3f-905f-fd70c786cbf2", "value": "4EF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950762, "uuid": "899bd778-7e74-4457-a219-250d200d1936", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950762, "uuid": "b0e53a48-b843-47cf-986c-839e1e1e812b", "value": "3072:OwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:OwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618950762, "uuid": "e8b35377-0539-48f4-a103-145c1b333781", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618950762, "uuid": "e1f3f0bf-5608-4519-b834-e534b1f14253", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950762, "uuid": "8aa7b23a-1273-4aa2-a4ff-14686187e86c", "value": "281be363ee6c8753e21746cd6109038ec537612969522b7464e623e2f203cff2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7561134e-a1d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618920655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920655, "uuid": "ebacd197-0da3-467f-8ef3-fecb8f4bc9a4", "comment": "Malware payload (AgentTesla)", "value": "be39908fb0cae5cdbbb7982a6ace4f23", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920655, "uuid": "86fc27ce-6f3c-41ce-8412-54968f7c6511", "comment": "Malware payload (AgentTesla)", "value": "282b5d50f956c8ac1dea9080f1ba21129ce937a6d234fad62e17136509ac5166", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920655, "uuid": "3ab3ffe0-6bf3-40ca-a397-3ec4ddf3c5e3", "comment": "Malware payload (AgentTesla)", "value": "f19fd7e8c80393e59ab19954d7b67b8323c0496e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920655, "uuid": "dba5f136-c43a-4eed-bd91-3b23b05daf3b", "comment": "Malware payload (AgentTesla)", "value": "294a484ad7087e9b3b339778cd27198673db50b6fd4f4c610aae12501470c68f08c51862f0e69214a33987798a688cfe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920655, "uuid": "9443825e-3ffc-4931-ba2d-154f9af32d84", "value": "4735E0217FE9CE55D2BA4B7884B4925493F8BC119F5BC30AFEA035DC9970FC86A13252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920655, "uuid": "2044cdb5-b299-49b2-aef6-883783ecfa4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920655, "uuid": "8b5676f7-2454-45ba-a1fc-74bd6b13e224", "value": "24576:HUHROBOobXdPivO3GDcdGXhbHiL+nRxxRRRRRNm:HUHE3bXprWDcdGXULCRzRRRRRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618920655, "uuid": "a66b72f8-6b5c-4995-af88-e91433d6a03b", "value": 1082368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618920655, "uuid": "ed70c676-2ff7-4fdf-a463-41b6512e777f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920655, "uuid": "34abb4a3-75db-46d2-aefb-676f2eed9fa7", "value": "be39908fb0cae5cdbbb7982a6ace4f23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7144b7f-a21a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618952226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952226, "uuid": "a7868e2c-98b1-4fad-8378-c50aae252d8b", "comment": "Malware payload (Dridex)", "value": "52efad4c43e23e4ca2b200636c5ad6a3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952226, "uuid": "3a6ab309-0c3e-4da7-ab57-27d7c283c953", "comment": "Malware payload (Dridex)", "value": "283c80d07f27fb4a9f2890ccac32faac674d2ce61ec380db1876db6f5a6da0e0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952226, "uuid": "a65ee9aa-0d3a-4dd5-8604-d74c6a1ddee0", "comment": "Malware payload (Dridex)", "value": "15d84d3334b71d13d76dcf3879ba4f2edd430bdf", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952226, "uuid": "9f4a63fd-f788-4965-a7ea-e6eb60d439ce", "comment": "Malware payload (Dridex)", "value": "4fd1b10c228e595b6f9c7e81eab79133b99f80133c3b5c73ff07db21e3562c81e83084a593591904aa9a1bfc90e2ddd0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952226, "uuid": "765d6474-13c3-4e15-a538-59e6c4373350", "value": "5AF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952226, "uuid": "e1b6217f-92c9-4eb7-8d24-23ea57349731", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952226, "uuid": "4e80bb36-d40b-46d5-9274-a1131b33f900", "value": "3072:uwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:uwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618952226, "uuid": "5ab30475-f9cf-482e-b573-62ffbb3a923b", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618952226, "uuid": "2b1283c9-88cc-4a01-89f2-138ec8613538", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952226, "uuid": "19687c55-8213-4d3e-bdda-3563c99f25f9", "value": "283c80d07f27fb4a9f2890ccac32faac674d2ce61ec380db1876db6f5a6da0e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33bc65e-a20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618946529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946529, "uuid": "28e0d21a-20fb-43d7-b08c-928781bf82bb", "comment": "Malware payload (Dridex)", "value": "7f291d12a917071a08ab2ee4f7bcaafc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946529, "uuid": "393287fb-e66c-4e7b-8185-9180b72c1edb", "comment": "Malware payload (Dridex)", "value": "2847ab5f6bbe83e04724a40ad055ffb63c2e93f982ca5f1b5d95d3647fc0d934", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946529, "uuid": "840de287-dbde-481d-a971-bb399f5a7750", "comment": "Malware payload (Dridex)", "value": "6a83c3339a531c8c14b2e278b58fb2a5da028a02", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946529, "uuid": "dcdff02d-62b6-460e-82aa-ddded607e5ea", "comment": "Malware payload (Dridex)", "value": "22ed368e137890517017509783d98281021a255a9ecae7bba2a7c10b75eef5dba14fd1d30d0c2b89a1fb9091fe2f65f2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946529, "uuid": "8a4e3873-27c8-4410-b0bf-f17fa89b3927", "value": "23F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946529, "uuid": "8db411cf-aced-47ab-a617-91cb1d5be498", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946529, "uuid": "b2a10f22-9eec-4c70-bf00-fc038c0d739b", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618946529, "uuid": "b19fc66e-e831-41e7-9da5-568696b4484a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618946529, "uuid": "302e517f-62ec-41c7-8e8c-6b64dfe027f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946529, "uuid": "1550d405-bae8-41fc-b1a8-582896a0e37b", "value": "2847ab5f6bbe83e04724a40ad055ffb63c2e93f982ca5f1b5d95d3647fc0d934", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1586106a-a16d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618877544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877544, "uuid": "1be7ae33-f404-4118-b3b3-1d6da3bb1031", "comment": "Malware payload (Dridex)", "value": "e45060b6f47779224a3540a083a58386", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877544, "uuid": "6719b7d5-638b-45aa-afd9-24171d014db7", "comment": "Malware payload (Dridex)", "value": "285736029d59f56a108f4347feed274d9b3944f1e1efd099be78f6b075f22af7", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877544, "uuid": "701e70d0-9fdf-4f87-94f4-3159e89e7372", "comment": "Malware payload (Dridex)", "value": "d854be900fcecf2d9c0e69c053946a361c123804", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877544, "uuid": "d151c31b-b76c-4511-b096-e98bc6c08b59", "comment": "Malware payload (Dridex)", "value": "b85d0c6d1864e00e9c26ade1fc09674d5164ba347d7a351a5f09ed07708a01b371952e3a395ead79b58e970f20838d47", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877544, "uuid": "cb95810f-c7cb-481d-90c2-9d42715373f0", "value": "4EF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877544, "uuid": "42985691-bfe0-455e-a16d-92c489ce696c", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877544, "uuid": "53ad7ddb-2565-4e36-b310-c1fb993e33da", "value": "3072:dWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:d42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618877544, "uuid": "21101161-052c-4ea5-bb82-6eaa9b3b7a8a", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618877544, "uuid": "eb709627-2a54-42eb-a857-324aa5e58bda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877544, "uuid": "195609a2-e10b-48e2-8093-9c91e8fa44b1", "value": "285736029d59f56a108f4347feed274d9b3944f1e1efd099be78f6b075f22af7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec9e9ed-a1ce-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1618919463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919463, "uuid": "532768ed-99c7-4e80-a102-ebba8d9d837b", "comment": "Malware payload (RedLineStealer)", "value": "1a6f4235f9ea6ab9e8a85f60093baf70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919463, "uuid": "8db014cf-3a5b-464c-9a0e-04d56c2a057f", "comment": "Malware payload (RedLineStealer)", "value": "286ac923f7619b720847b3820652ca94b3b09ee4885e581ced04e8f1395713b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919463, "uuid": "c9256c60-3b47-4d17-b230-55387c2ffc97", "comment": "Malware payload (RedLineStealer)", "value": "e7c6e26c44de9b0dc94693daf33bdd6b564dcc89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919463, "uuid": "d9dc5648-a103-48ec-97fe-956198897d4f", "comment": "Malware payload (RedLineStealer)", "value": "9230d7d24b13af7afa743d868facfdfd1fe2498565fad0ca645fd1bcc9f80098f9159eb014bf3f632e68d70bd40c1a6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919463, "uuid": "e0ec2e49-d04b-4559-b11c-21ff8810e318", "value": "9CF53321BAC694B5E1720E321A7AE324A53C7C211F188FDF73E4655E59311C2EA31B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919463, "uuid": "f7ef79ec-ce93-4220-b6cf-9b374efa309a", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919463, "uuid": "bbd8c9fa-dcf0-4763-920e-e0b9808414ae", "value": "98304:UbFx7gl8aeKrgZNSDpWWw6U+1QOw2kvpDH:ULLaeKrgZo/Ch75H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618919463, "uuid": "28dba1c5-e76e-4a65-8626-461bc7096859", "value": 3365867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618919463, "uuid": "edb13f73-576b-43be-aed1-1d58a4905a78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919463, "uuid": "64e87229-fb92-40d0-b9e3-8b14d6cf7a09", "value": "1a6f4235f9ea6ab9e8a85f60093baf70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5862acf9-a212-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948524, "uuid": "1967c7e4-84d0-4d56-a6da-2dc13a3d4855", "comment": "Malware payload (Dridex)", "value": "275c355daf5ed0130f46da92fb1cca71", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948524, "uuid": "a7db5b26-b3bd-45ec-bfe5-d5f308997785", "comment": "Malware payload (Dridex)", "value": "28da76e89ab67753b7a187bbfe4697cc207301f828ce91c9f678d1e36f9ccf97", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948524, "uuid": "358cc0db-1002-4f74-9dfd-004ecbd44935", "comment": "Malware payload (Dridex)", "value": "45f08c3d2ed297eb89ac55897651ecbca4354b8c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948524, "uuid": "72595c69-25f8-42a4-980b-817c6ede3c26", "comment": "Malware payload (Dridex)", "value": "cce5989c991a1ae2e0e5472809d9d67394099ae2c5c617379d62f3ac1ded09e2c31a1d10da070f64cbc122218bdfc7ae", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948524, "uuid": "3f2b5fe9-faed-43de-9f10-9cbbfc3547e6", "value": "3EF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948524, "uuid": "015e0c8f-d1cd-43b0-b345-11176b0a01ad", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948524, "uuid": "28c29923-a124-4a70-b533-c767583cc8c9", "value": "3072:pwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:pwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948524, "uuid": "293da593-e973-4363-a252-a6e3d12f5d9a", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948524, "uuid": "bc235354-a535-44e8-9954-63a7c073e494", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948524, "uuid": "bcbc7392-4c79-4a53-9fbf-2255fcafa4db", "value": "28da76e89ab67753b7a187bbfe4697cc207301f828ce91c9f678d1e36f9ccf97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531130ba-a1af-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618905994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618905994, "uuid": "9978ed9d-2e3c-4043-a0b5-3de76ce1230f", "comment": "Malware payload (Dridex)", "value": "f2d6b50ae8edb9f8c5ee78309c50afab", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618905994, "uuid": "d1b4a8b3-20a7-4111-b96d-992fcf89a09a", "comment": "Malware payload (Dridex)", "value": "29079822cda346567a80d4002bd5d53aa0fb81b9d4620fe8e03ca8149dd6672d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618905994, "uuid": "3b1b63ae-d6d2-4706-a823-7beb83cd663b", "comment": "Malware payload (Dridex)", "value": "0f31bc2fb595deecf56b1b99cc7dbeca46a9c3b7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618905994, "uuid": "f3e19171-0630-4089-b6a4-498ac61a6945", "comment": "Malware payload (Dridex)", "value": "7eeb1c4f8b95a234fbd755d72b021781c465b8cf3f71067a6f2952bd15170462ca71aafbf9b9ce9c447c435f921e4d50", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618905994, "uuid": "024d952f-c008-44a7-89b9-57d2f30aa883", "value": "44F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618905994, "uuid": "1cdf60d4-13d7-4369-b4fa-6e95ef7d09aa", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618905994, "uuid": "9b5c6115-8782-4dda-8873-9d8fdb91a504", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618905994, "uuid": "44d2222f-197e-49db-8a20-572b0f4c4b01", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618905994, "uuid": "b66f049f-607f-4f98-ad0e-79f9e927bf96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618905994, "uuid": "0b52b240-cb23-4014-9f01-f9ce8ebb8589", "value": "29079822cda346567a80d4002bd5d53aa0fb81b9d4620fe8e03ca8149dd6672d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267e78e2-a1e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1618930831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618930831, "uuid": "ecedf76f-32fc-4647-9100-7c6b4d90bc85", "comment": "Malware payload (RedLineStealer)", "value": "a74890b14780484c8e04de1c4d7880d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618930831, "uuid": "a26d369b-112f-425e-ad12-4310fce078ab", "comment": "Malware payload (RedLineStealer)", "value": "291179e14dba4c93c57181079f846487c100051b144d49ee88f922433511204d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618930831, "uuid": "7bbf6303-ced2-4717-b0b4-d6929314409a", "comment": "Malware payload (RedLineStealer)", "value": "3dffb7d6cf2c5e4810ac5e4292f6f7f746230f6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618930831, "uuid": "002d460f-639d-48e0-ad99-0d73bf92f30a", "comment": "Malware payload (RedLineStealer)", "value": "03eef1b7fa84e2081e4b53cbe64b9cb1f410bd04bf5f1be4d0247ab97757004246b2c62c7e1577774c722bf7a7f7f1fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618930831, "uuid": "70cbd150-881d-4d51-965d-faed0686de59", "value": "C5120918ABC4D671CDB70A70ECB3A7408B70E7500467DA9F6AD985576DE7F090AA23F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618930831, "uuid": "9728c105-b10c-4f44-9c25-e3a0554086f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618930831, "uuid": "a1118fd7-e141-4399-9c01-94b83101a0ca", "value": "192:hBksu/zHNQmXeMZZ3F93VnjdwqzN3rzpqPRA3P:aHZXeMHFnhwqJ/ERA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618930831, "uuid": "a93faec2-9bb2-4882-b2cc-12f6d7bd1c83", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618930831, "uuid": "e14c999b-3ff0-4dee-87b9-15c75ac5099a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618930831, "uuid": "aedacaf6-437c-470c-ae77-871a438b5821", "value": "a74890b14780484c8e04de1c4d7880d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4e6f42-a22f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618961173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961173, "uuid": "38b3f9bc-a252-4eb3-8205-cb11285715ff", "comment": "Malware payload", "value": "e08c1c1b5987e1873c11373bd548810f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961173, "uuid": "89626c69-7393-4a43-97d8-c1f2887f93ed", "comment": "Malware payload", "value": "293e858708f48d424b25e7b368125a919b1924c8da07091af891f6c415b2bf57", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961173, "uuid": "50e09043-a561-4efb-bbff-a1b1986f141d", "comment": "Malware payload", "value": "65553272bf37bdb3760505af21b37107c6771c4c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961173, "uuid": "13433af5-b936-4402-98c4-17fdf7eaa387", "comment": "Malware payload", "value": "c9524d46313a004c2fb5d95677eb49b2a91c0dedf4c86ae0efc617a3579a68fcf34d3b0d96a8f0fb15b64b6adf4d809a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961173, "uuid": "471ed579-bc7b-40ae-b597-1ecd903adda3", "value": "E4F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961173, "uuid": "72767c2f-0fc9-499a-b3e8-05c004d13f0a", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961173, "uuid": "c47fdf4f-cdcd-4cb0-b42d-08953bbdb03c", "value": "3072:7wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:7wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618961173, "uuid": "d323b894-2964-4d1d-b504-dbf6636d62aa", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618961173, "uuid": "7b45c834-7471-4893-9f59-7e12c3e8be8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961173, "uuid": "eee692c8-ea48-49ef-afe2-6d161044caa7", "value": "293e858708f48d424b25e7b368125a919b1924c8da07091af891f6c415b2bf57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313ecc23-a20c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618945881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945881, "uuid": "91b06565-91ab-479c-a9a6-8b772305e798", "comment": "Malware payload", "value": "d026c572c217358b2dfe2c42e12c0098", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945881, "uuid": "817b983a-1ada-4820-9fba-1e9d6cc289d6", "comment": "Malware payload", "value": "2961cee3fd738ec6d77adc870043a54e945d2e259c5cc0c81ccb4a911db0b404", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945881, "uuid": "815e7d1a-d99e-4fbc-9c83-669796d25b86", "comment": "Malware payload", "value": "79c905891798a07b24613f05b297d893c4a69dc2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945881, "uuid": "6840da1c-cd92-4aa0-8c90-23a102cd870c", "comment": "Malware payload", "value": "ea7e98c4b9e8d461d5da451c22d3210ac366680eed8ee7fe6ad8d3a8a6ba1eba37e015dc336600a05817c3983cb04547", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945881, "uuid": "d7e4e50c-9da7-4b12-a451-b71597075187", "value": "DBF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945881, "uuid": "483bf121-e3f7-4f51-8100-2181a421c912", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945881, "uuid": "981f3d41-b841-4b22-908b-a1836ebec747", "value": "3072:9wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:9wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618945881, "uuid": "9a9e87c1-22f0-494a-9e09-1fe4d61fe66f", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618945881, "uuid": "f4b9cc1e-91ee-4d6c-9c01-73f931d98b0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945881, "uuid": "18238717-550e-41f7-8038-246e30be9428", "value": "2961cee3fd738ec6d77adc870043a54e945d2e259c5cc0c81ccb4a911db0b404", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c532cc3e-a20e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618946988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946988, "uuid": "e33b4ffd-8408-47ef-b765-d7b34ea5eb87", "comment": "Malware payload (Dridex)", "value": "5dfde5b560ae40fb378d1117449dc831", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946988, "uuid": "fb30a2d5-ba86-4f0a-897c-f1129bdc6e00", "comment": "Malware payload (Dridex)", "value": "2965c66013cce40a77c820ab247e7ea27e701d633c586a681e0cbcdab998b7b9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946988, "uuid": "fbf14b53-995c-410f-8090-71527976cacd", "comment": "Malware payload (Dridex)", "value": "74bc08ab6565eb61e95314855aeeb1f9851411b7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946988, "uuid": "0f66f405-fcf9-4e08-96a1-6c9ab05dd8ca", "comment": "Malware payload (Dridex)", "value": "92124f2b856ac697591c410008b0dd5b5d2b7320c9a76e5bd0c9510d4363e19dabcdf397b734008fda39493122383f63", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946988, "uuid": "700b83c6-d23e-45f6-87e1-7567ee12cfb7", "value": "25F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946988, "uuid": "29f3ee8c-50f7-466b-a9c8-cfc21a576d54", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946988, "uuid": "7013b9e3-a87a-469f-959e-d77bd11aff24", "value": "3072:lwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:lwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618946988, "uuid": "b85a5672-f9d9-4dc0-ac72-e548352e65c3", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618946988, "uuid": "37670722-711d-4fbf-845d-eee0e2c3be39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946988, "uuid": "ae5569e5-3928-4493-85ff-7dddff1dd601", "value": "2965c66013cce40a77c820ab247e7ea27e701d633c586a681e0cbcdab998b7b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03bd7132-a216-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618950100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950100, "uuid": "59acb15f-0a0e-4f74-9d99-018855392c97", "comment": "Malware payload (Dridex)", "value": "f60e58e9a1b0c6ac32edfe5184dc1337", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950100, "uuid": "6fdb4964-deb0-42cf-bbda-e419d446a524", "comment": "Malware payload (Dridex)", "value": "29778db38b6103976af57a48ffee5f6ae2594d0a8680e30e828b8f418e077115", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950100, "uuid": "6deca629-6a9f-4c03-a484-73455b33ce98", "comment": "Malware payload (Dridex)", "value": "3a8ec11c56e8d2eb4261d87a61d832b048278635", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950100, "uuid": "f7d59859-d200-4195-b004-30a32912b93f", "comment": "Malware payload (Dridex)", "value": "0ca0fe6664dd4f921c678934bcceb6b00c3d6d1837a561a08e6dd35a5e5edc41f31e92b0fb89f63f754b003f7251f41e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950100, "uuid": "934f14bb-1ce2-403c-adce-4f80eeeda5ee", "value": "F3F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950100, "uuid": "fb8814c4-dae8-4b3d-8980-422132f32556", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950100, "uuid": "70d96494-247c-4e13-bf20-7a0b0d2026f9", "value": "3072:vwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:vwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618950100, "uuid": "ad93bf4f-c67a-4fc3-b75c-3cea00f77e11", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618950100, "uuid": "0ef8623e-e3c1-42f2-a182-1b0420012a52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950100, "uuid": "c6e1463d-d6cd-4d65-aac1-daa86213e46e", "value": "29778db38b6103976af57a48ffee5f6ae2594d0a8680e30e828b8f418e077115", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c1222c6-a22a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618958703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958703, "uuid": "db69aee7-f248-48a7-8648-7943d23fb124", "comment": "Malware payload", "value": "c7db235333d40a387be5bd9756b1cc99", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958703, "uuid": "59f74724-20b0-41e0-b42c-6e8d322284be", "comment": "Malware payload", "value": "29e40c9ff5279dd2f72f70367686df69c660d27cf91169ab68673b009d7b279c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958703, "uuid": "309de996-f893-448a-b859-a53e3e9ff0f4", "comment": "Malware payload", "value": "f3e401f37d3cc01af8a401e06a8dca2837f4fe20", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958703, "uuid": "7fdad9b1-f0dc-4e12-b1e6-181a9e5d00f0", "comment": "Malware payload", "value": "3c57559a3e3f6672b5401973cb0d7a92659de4e47162fb1053169402b688359d0196d9973f958ebd70dcba8ca55ff3bf", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958703, "uuid": "bd409930-3fca-4a47-871e-e9017f4a5f6e", "value": "EEF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958703, "uuid": "4d31920d-c12e-4b5f-9952-e996d7221754", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958703, "uuid": "0f625599-26de-45cd-964b-147473725d1c", "value": "3072:awZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:awZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618958703, "uuid": "97021b04-b285-47db-b28e-daa3e3cf5839", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618958703, "uuid": "6efbbbb8-73b2-4c27-bcd0-4d70a7ff0302", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958703, "uuid": "c1fe3834-37b1-4ab4-a254-f21c1d6229fe", "value": "29e40c9ff5279dd2f72f70367686df69c660d27cf91169ab68673b009d7b279c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69015fb7-a230-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618961436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961436, "uuid": "805aede6-fc0a-433e-b6cd-9c6f0f9a89c8", "comment": "Malware payload", "value": "48fc215851032486ce8d374500aeec80", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961436, "uuid": "ed386c37-1e0b-42a9-a33b-1c4b7edcdbc4", "comment": "Malware payload", "value": "29f6aa9d34510a3c98d0c9a86bcdb24cd4f7e92e4c420bbd94bb1e4e6f75a32c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961436, "uuid": "6aba2bdf-5e9c-446b-b72e-d8601e26e2b2", "comment": "Malware payload", "value": "a5fcad591966859b86c11c00085d2d4ea0fc941d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961436, "uuid": "e7507455-258b-4784-afc2-f0e6a79c0288", "comment": "Malware payload", "value": "a2cd4bd1213b8d879d9102c270ec30e6e52e25c5f2c94094109fd808c0c5e80d713836a220ddf9d119e77f9df88680e6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961436, "uuid": "560f4a88-6f85-459d-97fe-60a3d8746a91", "value": "F0F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961436, "uuid": "b9320153-3e8b-46fa-8951-150e71b7049d", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961436, "uuid": "4d07cd6a-5a08-4c3d-8f15-04a3d12a3506", "value": "3072:NwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:NwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618961436, "uuid": "9026d99a-f696-47b9-8d5f-4011b3e5addb", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618961436, "uuid": "a69c54dc-94d8-447c-80f4-894140ec7701", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961436, "uuid": "1caf9cb9-420f-4fdb-bf65-272ea115e240", "value": "29f6aa9d34510a3c98d0c9a86bcdb24cd4f7e92e4c420bbd94bb1e4e6f75a32c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a547b24a-a220-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618954666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954666, "uuid": "edfe0f32-e529-4418-a103-5f23b48b4012", "comment": "Malware payload (Dridex)", "value": "f9340c8066ad431cefe425068926712c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954666, "uuid": "79d83ce4-07ac-47d1-9f14-a208a8da73d1", "comment": "Malware payload (Dridex)", "value": "2a0d5d96f6c32a70cc43567f849e0c12e21aead62f5eccb5032597d3535aa73f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954666, "uuid": "177d4c1c-9c8a-467f-b0b0-40c132da3a67", "comment": "Malware payload (Dridex)", "value": "f9c21bd486eb800ccfae2cf4600d7dcb4482976b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954666, "uuid": "79913c9a-a662-465f-8da1-7b5c600a1f37", "comment": "Malware payload (Dridex)", "value": "5a1a611bd33e37f347af0af9224f458828514c9b3be51ff863d40aef8ce06f70676b1888971dea768bae19b1e57ad4af", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954666, "uuid": "92fd7241-8930-4359-8bc9-0ea4a2f9057f", "value": "FBF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954666, "uuid": "4c535553-17c3-4d4b-b389-4a61152f47ba", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954666, "uuid": "6b80a23b-7b18-434f-ada9-f41cdd1e2356", "value": "3072:TwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:TwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618954666, "uuid": "4369968c-70d2-4c0b-a079-ee313688f819", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618954666, "uuid": "af2316e8-0947-4a88-8c5f-29792df4c167", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954666, "uuid": "eb379ca7-ad88-44d5-b260-8224b31faa88", "value": "2a0d5d96f6c32a70cc43567f849e0c12e21aead62f5eccb5032597d3535aa73f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ea3cda-a1a3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618900971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618900971, "uuid": "fe9b7cc6-1cd9-4b3c-adfa-c70ab5fbf6b5", "comment": "Malware payload (Dridex)", "value": "3b084aff1c6b9e6197c7ceb8a14e43bd", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618900971, "uuid": "4a797a88-a2b3-48df-98eb-04c51ef1eb02", "comment": "Malware payload (Dridex)", "value": "2a385482b689145d41dbfbffe6f96a2acca9af82a6f312033dfc1114307ee94c", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618900971, "uuid": "5db1f3df-f67c-4f40-9512-ca6e1551e15a", "comment": "Malware payload (Dridex)", "value": "4260eb0c930bc7e70639aec31908c8f6fb8dc118", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618900971, "uuid": "92ff462a-a071-41d0-9b77-d385aaf05d98", "comment": "Malware payload (Dridex)", "value": "fe135ea051f0ed3de766f3976cad6cc6d27042e3ad69aa4f7759b484c4ca2b9c839e239e9162ef9d859849a415ad7767", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618900971, "uuid": "c31fe6cf-94b9-4038-b846-60e39fa7fad3", "value": "1DF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618900971, "uuid": "d4c7ac2e-a14e-4291-b1d5-86b19188fd56", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618900971, "uuid": "6acaf82b-8a76-4d84-93a9-390a1f50b0b1", "value": "3072:qlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:qlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618900971, "uuid": "6fc8da4e-9006-400c-b9ae-800ebaeddcb6", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618900971, "uuid": "580d39a1-5547-41f1-a470-5d3a86040069", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618900971, "uuid": "d9403841-cf3f-4603-9576-1650b57635bb", "value": "2a385482b689145d41dbfbffe6f96a2acca9af82a6f312033dfc1114307ee94c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64ebdcb-a1e6-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618929891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929891, "uuid": "3c2250a4-22a1-4bc1-a1fc-2e78a0cbba98", "comment": "Malware payload (AgentTesla)", "value": "0389d0b86a7342d646fc52945033e0c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929891, "uuid": "0ad00087-385c-421b-94f7-82d050aa3756", "comment": "Malware payload (AgentTesla)", "value": "2a39871fcfc1b15b312efc820839f57a21288c09be793ca1ddaf41d821ce3c01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929891, "uuid": "9f00c064-ceb3-4ced-8474-edb9428906ff", "comment": "Malware payload (AgentTesla)", "value": "6d1fa84447923f045673c8510269cc8679332322", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929891, "uuid": "6ae0be0b-9b2f-484b-b71a-fd7d47a98453", "comment": "Malware payload (AgentTesla)", "value": "2e51b3b55014734e3c46a61ef9b8d06b906fcc47427c18bc2e69193d176ea6bef4c2cf0de9ea4b40b632ed3891219df6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929891, "uuid": "a48b6f97-154d-495f-9e4f-a59a6f7d177e", "value": "B6F2C55A1051B158E5E749743C12ED783F28A3716880D14EF4A6825CCF82AFBB4EDDEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929891, "uuid": "ac5e06d1-2edf-410c-be4b-af40dcb0cde0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929891, "uuid": "fd593ab4-d7b8-45e4-95c7-79443464a11d", "value": "384:ehZCepmi1aGEvnaWMsd6XZBeNNdcxPCU7mDeSKXNEwvJou5nG54nC/c2FU7eaFCd:e1pX9KKZcNNd5U7m/KXCAkkiU7C4hgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618929891, "uuid": "43679022-ade1-4a0a-84b7-d681abdcbc3b", "value": 34968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618929891, "uuid": "f2cf0bbf-f140-47e9-8377-3d7e9929fa8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929891, "uuid": "07e837db-23e7-4fd0-a1aa-173ebdddd040", "value": "SecuriteInfo.com.Trojan.Siggen13.10233.30629.5748", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c76a8ed5-a21b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618952575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952575, "uuid": "bcf167a7-e453-4358-8884-86b340e74747", "comment": "Malware payload (Dridex)", "value": "39a428dfd6e1fae213ae8eb20406dea4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952575, "uuid": "40a3fb81-d22f-4332-9dbd-29791ca8f6ea", "comment": "Malware payload (Dridex)", "value": "2a57b33baa8f691a1e48cca6dce2e024442fb2a335f18ea497e2b17369676cce", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952575, "uuid": "76be2de7-bd52-451d-b3da-0150350c70d1", "comment": "Malware payload (Dridex)", "value": "f14b4c2224f2ad02a49a4dc3c0a52ba41048ebb0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952575, "uuid": "df588c02-9209-41df-8ce8-125199d6505b", "comment": "Malware payload (Dridex)", "value": "6ab2f47aff93dd78ae01de57e819874acc085caab26f35aa1d45c42b70575e45db46d251656100afe8480e6466f1a250", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952575, "uuid": "655d4a67-c07e-4aa2-8252-736fcb0f37da", "value": "6BF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952575, "uuid": "851e8427-ac6f-460d-9675-a2a5821ad880", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952575, "uuid": "13068c77-2030-4127-8c2c-373134a15c2b", "value": "3072:4A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:43J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618952575, "uuid": "462068f8-3a6a-4151-9aee-a6ce5e086736", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618952575, "uuid": "5135b36b-d71b-4205-a4de-1f1e795d0b97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952575, "uuid": "b75df7f2-bd17-413f-ab8c-58b2c325cc59", "value": "2a57b33baa8f691a1e48cca6dce2e024442fb2a335f18ea497e2b17369676cce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0b4a6d-a1e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618928211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618928211, "uuid": "b8c2a2b1-c31b-49d5-8553-b7d4949fbb82", "comment": "Malware payload (Dridex)", "value": "68182add517b2ec1233e9bce7785523e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618928211, "uuid": "e5a32b82-538e-4392-88be-12b9ff7d640c", "comment": "Malware payload (Dridex)", "value": "2aa67dda5ece47fa97674de5f916409d34bb6a47c52e63b503f9a9441494c7b4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618928211, "uuid": "915efc44-2893-4f1f-9d3f-bd979329f722", "comment": "Malware payload (Dridex)", "value": "bec73e1ccf5bb851ed73d01eded63c54d69580d2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618928211, "uuid": "18ef07c2-4729-4389-bd65-f5646e5e2cef", "comment": "Malware payload (Dridex)", "value": "bd5e80eae1569cc3beb521a9ccf274de160b168bccd8b39534cbdb6d057bd28e69c7448e65f9eb8fa03f0d3b19e2fbd0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618928211, "uuid": "1baabdc2-05b7-49f8-b2d9-efc3283875ca", "value": "6AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618928211, "uuid": "2e5fa1fd-551c-4696-84ff-5b380a6bf0d5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618928211, "uuid": "bec3e9ae-d538-46c1-83cf-e288088aec18", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618928211, "uuid": "c4cae48f-8ba3-491b-8a75-c9e2b81d6f61", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618928211, "uuid": "188346d5-7f3c-4118-b2bf-49b28d193ac1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618928211, "uuid": "cd5edfd0-e9db-4bf1-8f6d-d4f62872e937", "value": "2aa67dda5ece47fa97674de5f916409d34bb6a47c52e63b503f9a9441494c7b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671597bf-a223-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618955850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955850, "uuid": "b63a0827-3b4d-4418-bf1a-a69eba4c36f8", "comment": "Malware payload", "value": "3f201a0e3fd5bf242d5a254ebd0b71a3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955850, "uuid": "d5aeacd1-e7b3-4c0d-bf56-48dacf7e42aa", "comment": "Malware payload", "value": "2adba30a8681f4201f6a706b05d6289aef85abc22afa14c2f1bc28b85d98f811", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955850, "uuid": "d2770b6e-2614-4f36-a59e-88e43c29e76f", "comment": "Malware payload", "value": "66eadaf1b3953b0cdd3f8464df65984dbaafaacb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955850, "uuid": "31c47a84-fd39-4852-944f-1bc15cfc735d", "comment": "Malware payload", "value": "1fde93ed694c9fced78d37540103652ecaa99dede91cac6c9afb61c6d93218b9b450c1223c57baca012fef8926867ee3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955850, "uuid": "f5bbb871-ef62-4c73-a278-2157f6037cdb", "value": "F7F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955850, "uuid": "62cc54d2-47c9-45bd-8817-893dd37b41a2", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955850, "uuid": "0b19f587-47f1-4eef-a230-566716323a44", "value": "3072:kwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:kwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618955850, "uuid": "1346ac51-681e-492e-b000-463b1301ee65", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618955850, "uuid": "a2933047-8f02-45ea-938d-fc8519d5b7ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955850, "uuid": "8f1d3c20-f436-41cf-9ac1-5bce0b32980f", "value": "2adba30a8681f4201f6a706b05d6289aef85abc22afa14c2f1bc28b85d98f811", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f723b8-a190-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618892687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618892687, "uuid": "2f9793ee-5111-4958-bb4e-c6a34cba6a07", "comment": "Malware payload (Dridex)", "value": "b2349efb54c0c9f996896f55e4b84761", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618892687, "uuid": "5cdc57ca-e8c7-4d4e-a1a5-3a10387951a9", "comment": "Malware payload (Dridex)", "value": "2af45dbac43c2a79eb3bb19296238102af1b36e78fbfbee01ef5bf8d0b59bb43", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618892687, "uuid": "4c3fd1f6-7d24-44a9-8402-c36c4d9aa02e", "comment": "Malware payload (Dridex)", "value": "7beb614f4eaa3559cc573db7f4756300b1a26132", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618892687, "uuid": "6ba7e4fd-44d3-4534-9854-08d753730c0b", "comment": "Malware payload (Dridex)", "value": "3d1f10e522a1b2b1ea0f20404498dd0a64238ce7a420064c0b421820c1757d32a011ae54ef931a1654fdacbdb8e2c9fa", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618892687, "uuid": "58cd3475-b16f-4669-801d-fff450f6660f", "value": "A3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618892687, "uuid": "2102e6e9-812f-4cd6-8b59-6bb0661e7988", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618892687, "uuid": "3f7f35d2-2500-4a3a-a3f9-d3a615c7a89a", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618892687, "uuid": "7ed25e2a-cefa-403d-80b8-a925aa5a2324", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618892687, "uuid": "d4b152bd-d9f1-4eeb-bdc7-1ffce07225c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618892687, "uuid": "30efafc2-a31b-422d-bd3b-792da7f6caf4", "value": "2af45dbac43c2a79eb3bb19296238102af1b36e78fbfbee01ef5bf8d0b59bb43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f42bbd-a1f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618934245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618934245, "uuid": "895ead8d-7f8c-4519-b8de-d905ea0bee8a", "comment": "Malware payload (AgentTesla)", "value": "4c423f7aa8fdbddb1a64103baaf81111", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618934245, "uuid": "948d6c76-4aea-40db-949e-5cb4fcc31c3a", "comment": "Malware payload (AgentTesla)", "value": "2af9a6224f6007da01386aefa8ed531fcfb3761a31f3c2e3ae977005449682d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618934245, "uuid": "b0f0984f-637f-41da-b4fc-1dbfb43013bf", "comment": "Malware payload (AgentTesla)", "value": "b28d86cbbab6f880b6520503d3cbe613ed08f9ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618934245, "uuid": "66541be5-9dc4-42f6-8499-43456208fc7a", "comment": "Malware payload (AgentTesla)", "value": "27df16ad7cb1831ca7dad47e2ef7920783bc0f536774b42c377addc30a898adeab74f4f3ca36bfe5d94b4983c33ea762", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618934245, "uuid": "4998883e-1977-4a88-9d41-340dfbd390ca", "value": "C035CF253FD5CF25D27A4B7848B49214A3F8BC229E5BC70AFEA035DC8E70FD45A16252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618934245, "uuid": "5019af2d-3c15-45d0-a832-862b59ecbd6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618934245, "uuid": "cc43ce27-bc57-442c-adb8-eea1cd22d12d", "value": "12288:3dxU2efaQe6OBOo3rXqHy5SqvzRRRRR69Pq4k+44OX++d0KjkbV10SFa5UFhGtal:CfHROBOobXnRRRRRKk+48PKcV1rhnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618934245, "uuid": "e3afdf39-5b3f-4fc0-bb34-4e530e5de3b1", "value": 1079808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618934245, "uuid": "11d26ea1-8f7f-45b3-8b7e-c8b50800dedf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618934245, "uuid": "ab127d48-4a55-4fec-83bc-ff0b59bb8089", "value": "SecuriteInfo.com.Trojan.PackedNET.667.5184.4306", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4f78f36-a19d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618898455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898455, "uuid": "7556e87e-2525-4e80-a33d-a59675cdaf80", "comment": "Malware payload (AgentTesla)", "value": "85bec1ad53593edfc02c46dc42102c74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898455, "uuid": "219efe6b-c5be-4865-9f2f-efc122396580", "comment": "Malware payload (AgentTesla)", "value": "2b1611385291864fe7aa42dbc429f94ec4e42570ec627609407fc9889623f426", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898455, "uuid": "5029398b-5c14-4b7f-8862-bcbec4e1b8b7", "comment": "Malware payload (AgentTesla)", "value": "64df5c2489b1384db7507252ecaa5bc7c0ff3911", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898455, "uuid": "f1eab92a-d286-41d8-a53b-6d1fe6c479af", "comment": "Malware payload (AgentTesla)", "value": "fb02cbf361bdded12434acb8cb47bfb8b885b63a3a0ccfaa72c7fb17c73e1fc78e2c02cbc52e4629380b400906f8f96f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898455, "uuid": "d68fb4fd-990a-4fe9-aab7-de7b30d997df", "value": "35155B9C725075DEDAABD2758AA45C64EB503C77534B420BE02331BEA93CC87DF160BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898455, "uuid": "2f25b457-84f9-4a54-bdb0-e6c4e1b29d90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898455, "uuid": "431227d9-f6e3-4596-bcbf-85e7aa577461", "value": "24576:NKX/+ugidbgOLsk1cGMma0A8PbFRRRRRGB9Hekeh:YVgidEOLs3G80DFRRRRRGBJek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618898455, "uuid": "a16e1e8e-6314-402e-823e-1b2f31bdfc98", "value": 943616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618898455, "uuid": "0f6f9815-fba7-404c-993e-8363b04f77bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898455, "uuid": "d7ef9afc-e1dd-4726-aff5-feca568adcdc", "value": "GS_ PO NO.1862021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169e0b69-a233-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618962587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962587, "uuid": "7f3e4bd0-8744-4dd6-8e75-752a9ea47990", "comment": "Malware payload", "value": "4afd82ff462efff71feaeac8e84d8105", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962587, "uuid": "93695789-7cb6-45d6-9bd8-84a47ab587de", "comment": "Malware payload", "value": "2b3325818d6744ccf5da4c1f93095c7cc3ba5146d46d7cecda7fe68f72350619", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962587, "uuid": "aef18620-7f2e-40f7-91ec-f1e3f7179444", "comment": "Malware payload", "value": "1d2cea0a6fc3e9f13c4a2e4e7ce7f2dc201d01a6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962587, "uuid": "28f18e0d-bc3d-46ba-af5f-4a737eef2501", "comment": "Malware payload", "value": "c5f87f84299b06a9348b538ea84949ac70a39553642dac0bf2804da64b509628dc61a4a371d88a32ff285bef7bef7482", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962587, "uuid": "5b5055aa-9218-40b5-82a9-d354c1a40905", "value": "1CF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962587, "uuid": "ff3f3448-9149-4fd9-b7d4-6e7d28e4127c", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962587, "uuid": "e492d1d9-8c72-4ef8-bad3-7e4f1fe3f791", "value": "3072:EwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:EwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618962587, "uuid": "0954034f-6f97-4d65-9013-67e67a6b4912", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618962587, "uuid": "22f0f18e-161b-443c-9874-3d486f6569be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962587, "uuid": "4fd7232f-c73f-4fed-b78c-f7cd248f5671", "value": "2b3325818d6744ccf5da4c1f93095c7cc3ba5146d46d7cecda7fe68f72350619", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f76e024-a188-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618889211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618889211, "uuid": "2104b160-5e90-45cc-bb5b-019ab8b2bab0", "comment": "Malware payload (Dridex)", "value": "0cf1ec186f70cd06f3982340ce469985", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618889211, "uuid": "649a148e-f806-44a0-bae9-85a8febe3ca9", "comment": "Malware payload (Dridex)", "value": "2b37f43b11c771ffafee0c2638b5ef802275303781de26848549e3bc9c2e8f2b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618889211, "uuid": "478a5e7b-abd6-4aa6-8557-1dd8fdfa3d87", "comment": "Malware payload (Dridex)", "value": "7b3216eeb60f70e3dc6287dec1057b86702f60a4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618889211, "uuid": "d47d2a13-d52e-48b1-8cf8-c2b26016e328", "comment": "Malware payload (Dridex)", "value": "8cc1a6466f265cd6d07dd25d31a9d6622a79e2b84b104d99a3544dfb7ff57fe5f14ce4ad55ae715243e10e6d91d7bbd7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618889211, "uuid": "f052782e-a958-4ed2-8020-cd519e395d86", "value": "E1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618889211, "uuid": "7fba39d9-8947-47f4-b91f-daa73fdfbb13", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618889211, "uuid": "32ccf35e-e75a-4872-abd8-107de271ac1d", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618889211, "uuid": "20efbe43-a8b9-479b-b2a3-219a54ee22e7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618889211, "uuid": "aa2bec0d-6527-4401-bae8-2f75ff0b4fa3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618889211, "uuid": "39c7a8cf-cb00-44bf-a025-bab2a3f5666b", "value": "2b37f43b11c771ffafee0c2638b5ef802275303781de26848549e3bc9c2e8f2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3631f718-a16c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618877170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877170, "uuid": "656418a5-eafe-4fe6-ae52-a0133c661686", "comment": "Malware payload (Dridex)", "value": "c7ec7236ecfff4a02a30adf6a5d5ef3c", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877170, "uuid": "b3771d60-b7ae-4e20-9aab-4fc100a3a5bb", "comment": "Malware payload (Dridex)", "value": "2b3f3731146bcfe24ceaf1f8b5a50dacce186a16cb3c8afeccda975ff850328d", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877170, "uuid": "eea406c8-dc41-4a5a-abdd-7f37ea9d24af", "comment": "Malware payload (Dridex)", "value": "4c96c358d2ca69baecfc0e56a08a48b439052c72", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877170, "uuid": "e07d1545-4a41-40f6-ba92-0a418f314be6", "comment": "Malware payload (Dridex)", "value": "bb6cc30c2dfb19e78aa68c08d22050346f9c8298b0e3db20c5e9a4e60c972d838153db55ca92464224670601f2cb818c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877170, "uuid": "8a94cf66-61b6-4a99-92af-4f714170fb45", "value": "30F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877170, "uuid": "ae884d69-91a4-46fb-8c1e-61b84bef72ca", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877170, "uuid": "c1a1bb8b-7458-48c8-be9b-0fa7950dc9f7", "value": "3072:0WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:042IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618877170, "uuid": "c960486d-ada7-4bfc-891a-db49551ff743", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618877170, "uuid": "e1be76f7-e852-41a9-9352-3671d79fbbcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877170, "uuid": "fbd486ab-441a-43b5-8299-1821e6b5ce8f", "value": "2b3f3731146bcfe24ceaf1f8b5a50dacce186a16cb3c8afeccda975ff850328d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4429f70-a1fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618939739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939739, "uuid": "9c16a94b-6b74-4662-b202-cbecba39a8dd", "comment": "Malware payload (Dridex)", "value": "f6f2d2bbe5c0ed59bc34675cd0fc860e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939739, "uuid": "4ba7cc8f-b3e6-40b6-961f-d009ac24bd2e", "comment": "Malware payload (Dridex)", "value": "2ba7715c38f3c4d1a5294cbb1fbf3f134ee2e19b354388ef522771b24660918e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939739, "uuid": "295a6f26-d094-4b76-b943-20548f246df8", "comment": "Malware payload (Dridex)", "value": "5836bf0a345f15752b09158a31eb06fb3a828ab3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939739, "uuid": "8797b959-5512-4824-a782-a7c35477291d", "comment": "Malware payload (Dridex)", "value": "f4ea064a2c4f8f7c3e4522c98634db87a90454cc2ac5e951d5ebd5c622213f0320567fb913ac8407b69ce31530872479", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939739, "uuid": "85494e63-1b76-4e70-8b8b-5b66574f07a4", "value": "A4F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939739, "uuid": "bd526593-f0f3-4d2f-a71c-4aed1d05fcf7", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939739, "uuid": "9b7dad07-8a68-439e-a2f5-49c4513d4721", "value": "3072:/wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:/wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618939739, "uuid": "48085cf0-812a-47e9-8c0b-04220bfbfa18", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618939739, "uuid": "9a52aceb-aa5f-4f37-9828-798c3c4832e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939739, "uuid": "004cf53b-d02e-41f9-a45a-e3bbe0f8185b", "value": "2ba7715c38f3c4d1a5294cbb1fbf3f134ee2e19b354388ef522771b24660918e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fb879c7-a207-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618943731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943731, "uuid": "a1b65bf8-f1a4-4b43-86dd-d0c7bdf2cf92", "comment": "Malware payload", "value": "470f005aacf94876526eb69ddd1b4386", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943731, "uuid": "6f13a199-9ad3-46c5-b67d-87b94941e086", "comment": "Malware payload", "value": "2bb4c4651c4730601693236923fe369076b1baeee3a8d5c6897491abd013e6d3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943731, "uuid": "444311df-782b-44b7-afb7-f4937071def7", "comment": "Malware payload", "value": "cc9fc962192e3b87bb9bb61a5d9032f090222695", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943731, "uuid": "6f32f364-eddc-4365-8ac4-9e3e2e4fe5f2", "comment": "Malware payload", "value": "c70cc0e683f65bbcb4e37fe3d04fdd4c555504d171854740b1d4d76d4ecad0a014fb79c81a0bd79105afae1509107bc6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943731, "uuid": "c127ef4a-b0a3-487d-8a1c-75cca32ea803", "value": "06F3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943731, "uuid": "47709846-6eb0-4dfb-80f3-95de36b82c35", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943731, "uuid": "a6b115a8-48a9-4167-a92b-b455739b5499", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618943731, "uuid": "82a9e96c-7967-46ef-9aac-9d0dfba89364", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618943731, "uuid": "4b6b321e-f850-4d05-964d-869931289d71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943731, "uuid": "97583d8d-6deb-4053-a92e-e79c5e7f4e42", "value": "2bb4c4651c4730601693236923fe369076b1baeee3a8d5c6897491abd013e6d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baeda5f8-a228-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618958138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958138, "uuid": "bc613622-a650-4c67-b017-7f46e879cb67", "comment": "Malware payload", "value": "2a2e6493034dd932b09ad9606aad8442", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958138, "uuid": "4e27833c-ef4b-41cf-b44a-640bfd75d36b", "comment": "Malware payload", "value": "2c24982bf624c6774b2868fea0383a53f3b008457806522f580dc9fea4cb6403", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958138, "uuid": "0c633d37-c1b5-4ad1-859d-d5c564ccb4d3", "comment": "Malware payload", "value": "58b5101c58a5604ea139353faaab7930fb31d747", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958138, "uuid": "8e67f65f-6e2a-452f-acf3-81b2c523690c", "comment": "Malware payload", "value": "ff11f9b519762483a01b436e70a393a1218c7204f4c352e53d05392de99b2dfbfdb56cf80986193664c845935a998a0e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958138, "uuid": "4eac97ba-684d-4464-b1dd-87bc21cf1254", "value": "B0F3D081E78FE451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958138, "uuid": "b085fd15-315c-484c-9025-7a088b716c37", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958138, "uuid": "54214ff3-e9ad-4087-8f6c-d0d285d75219", "value": "3072:1wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:1wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618958138, "uuid": "71672591-1ab0-4648-9917-1ffa85535f56", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618958138, "uuid": "b8a557ba-612d-40e8-922d-35cdd5f872e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958138, "uuid": "afc43b4a-802b-4ae0-8b64-b1569328f238", "value": "2c24982bf624c6774b2868fea0383a53f3b008457806522f580dc9fea4cb6403", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436ce7a3-a1eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618931738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618931738, "uuid": "381670ed-d66f-470c-86e1-1be4022ea6fd", "comment": "Malware payload (Loki)", "value": "671e8b04ebdceeda907308de91e6868d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618931738, "uuid": "1d2291de-deed-4ecf-872e-ddffd1b00dfc", "comment": "Malware payload (Loki)", "value": "2c39825f15f588b33582fdf02afca97bd41cc2bf94be42926de9fbd10fa82691", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618931738, "uuid": "77d54a3b-3ad4-4af4-87e3-8917d9ac4dc5", "comment": "Malware payload (Loki)", "value": "5789317d59eb7e3bc3aae2d2af4bf0189e3f764a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618931738, "uuid": "66efacbf-049b-4a7f-8c91-a529f053dd93", "comment": "Malware payload (Loki)", "value": "84f57e07ba2fb6e413416827f5c474ec28f0befc8f935a00dbf6db2bd3a4e26986b9b3e69acc9c5a44c4ff7b9907e97f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618931738, "uuid": "5c9e9a59-6775-4611-9be9-a8d05679c4f3", "value": "36058D307E576B49E43D8FB0742042409FF6E94AE725DF4D7FB809AC1E62A4287917B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618931738, "uuid": "50c1491e-aac4-4897-a02e-341f318fdce1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618931738, "uuid": "44b3582e-8997-4893-9c95-58e903c1a079", "value": "12288:soNH5jxSzRRRRRKGkY1ix+ZGS9s7KEtYMejCgI5:sk5cRRRRRKHIz9srtYM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618931738, "uuid": "6ece8fd0-75f0-4ee0-93aa-818b64927ab0", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618931738, "uuid": "fd662db5-cfe8-49f3-947e-ef5b00a69386", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618931738, "uuid": "5b23d3b3-57a7-45b0-b599-ae3af2b3d91e", "value": "orden 675 recibo bancario .pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfeaf68a-a20e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618947033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947033, "uuid": "c2bab47a-cd33-4b36-9b91-4bb1b66e6d78", "comment": "Malware payload (Dridex)", "value": "f970b954a8d00231fab9ef20d1c88ed7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947033, "uuid": "c15b9250-7215-45ff-99e7-deea64d381f6", "comment": "Malware payload (Dridex)", "value": "2c40fb609978b03b8bf3d769f9e4e02b438129c04f2ffca5af11e501f5d3f03b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947033, "uuid": "8b93de68-c4f4-4760-bdba-2f7ff9fcbed7", "comment": "Malware payload (Dridex)", "value": "e224f36be0380eebca41bb1dd1cbf63b38781dcf", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947033, "uuid": "c199b007-2a0f-4322-8516-f0128d01d5bf", "comment": "Malware payload (Dridex)", "value": "f5d049953f1a0bde844321b26c9d1c37162506ff1722ac7b730e02dc451c7a85fafe0ce0527623b22f7656de21b9bca6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947033, "uuid": "325af7f8-e41c-493b-a7ac-3779eb989436", "value": "37F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947033, "uuid": "585f6a84-95ab-4d5f-aeb9-eb5918594699", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947033, "uuid": "e1baf923-eee6-49eb-93fd-23558c83e8c0", "value": "3072:CwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:CwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618947033, "uuid": "a95d9168-aec7-47bc-b0d9-40ccf0b05932", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618947033, "uuid": "1acdd7c1-a03f-4c43-bbf4-50a71f5e35ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947033, "uuid": "0bfd4eda-04e1-41ff-a3bd-8f43bf1389ea", "value": "2c40fb609978b03b8bf3d769f9e4e02b438129c04f2ffca5af11e501f5d3f03b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "162d6857-a226-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618957002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957002, "uuid": "9db6bc5d-ba0e-4c9d-83e9-1be0b0c7939a", "comment": "Malware payload", "value": "b0c3f39070fb5cb2be07b44d8bab709c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957002, "uuid": "a5319bbd-13dd-4837-b75c-82dfe80f5911", "comment": "Malware payload", "value": "2c6e1dfdc5fe5233c28fc11f971e2ec47581e9dfb36021aef8b07a9991261c2e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957002, "uuid": "12dec9e6-f9b9-4a9f-8c1f-02be84e3f4f2", "comment": "Malware payload", "value": "ee5fa805fcc813752b1e7738c15b19afd409263d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957002, "uuid": "e077cb2d-0b7e-4094-ad0d-7ae87f1c27d4", "comment": "Malware payload", "value": "0e462a4c8717654f0e3c75849bd9d7c3319b46ed9d24a0c97c002cb2054b6ed906d270ee9e96243187b2798bbab4fd1f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957002, "uuid": "85bde97b-77e8-4811-9b2c-9222847197d3", "value": "80F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957002, "uuid": "86d76ee0-278a-42f9-8736-193d1a3bdd8f", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957002, "uuid": "613f74e9-102f-46ad-bb71-8b82b1bb9288", "value": "3072:WwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:WwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618957002, "uuid": "829076dd-8cc1-442f-8b0b-a0257bab0f3a", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618957002, "uuid": "b515ce77-282a-4141-83b2-643e4f2f0d0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957002, "uuid": "279de2a0-d713-4ce6-bd00-9a066159eb87", "value": "2c6e1dfdc5fe5233c28fc11f971e2ec47581e9dfb36021aef8b07a9991261c2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9b9712-a20c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618945903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945903, "uuid": "4c3d3eff-ec33-4d7e-9e3c-8a702b97c44a", "comment": "Malware payload (Dridex)", "value": "b3d49b763af6f9b9b6690434b96761d8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945903, "uuid": "2f20531e-2f89-49da-ade2-cb31f7fe956b", "comment": "Malware payload (Dridex)", "value": "2c8fe01f48420dbdd2736443a6c871c25b015b566e49bd12db54ec96705e02ec", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945903, "uuid": "eba05ac8-ebaa-42f6-8f0e-c3ace8c7c629", "comment": "Malware payload (Dridex)", "value": "2902684981d6e8dea0d8673c0a951570b46fa58b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945903, "uuid": "5220963c-652a-4ae1-bc44-1fdef81fc967", "comment": "Malware payload (Dridex)", "value": "2af9c1048fde128408214935bf0222615461ef99c3be95bf376903f4283e45f148b03a2607fc82c9a48c0f55d4ce8fc4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945903, "uuid": "a20f2559-a254-4086-88dd-7380e71bd742", "value": "84F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945903, "uuid": "848d0469-c45a-4323-8c66-b2f405cd47fe", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945903, "uuid": "e8bded19-93f9-4354-b517-91a90c966f89", "value": "3072:cwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:cwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618945903, "uuid": "f3261a39-54cc-414f-9497-fb93015db88a", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618945903, "uuid": "0109e06c-4fb9-486c-8d95-7a97e3a727be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945903, "uuid": "b71f022f-d26c-4b1a-9975-98efffda77a1", "value": "2c8fe01f48420dbdd2736443a6c871c25b015b566e49bd12db54ec96705e02ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b313bafb-a222-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618955548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955548, "uuid": "19e9c987-d25c-48d6-8a1c-24527cc4f5cf", "comment": "Malware payload (Dridex)", "value": "959319656b066ebed59eb5e15621365d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955548, "uuid": "37f4ba53-4f28-4948-b254-eb1f6d3be215", "comment": "Malware payload (Dridex)", "value": "2cc911dd5282ee818f73f8f136f276f146b85e2b07d88a46af8bf9c93f8dc93b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955548, "uuid": "0c9b7413-0cc2-49eb-be06-d663bba61558", "comment": "Malware payload (Dridex)", "value": "3871dd5a244a849e612301641509d1801b00dd4c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955548, "uuid": "b674b1eb-bcd4-438b-8bca-330773e30588", "comment": "Malware payload (Dridex)", "value": "c789c0213611b25fc384fa3f95a8175f77d805451efe20beb8a648a237cff0dcd4b26e5697902efbbb58b198fa0df359", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955548, "uuid": "5481901f-be07-4533-8867-1a86ea4d345f", "value": "0CF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955548, "uuid": "499dd1d3-b7a8-43b6-8d04-70ffba74faf7", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955548, "uuid": "fb8998d2-61b3-402b-a037-31198f35f3a6", "value": "3072:HwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:HwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618955548, "uuid": "214de847-51cf-4fae-afdd-e0853b396431", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618955548, "uuid": "1c515744-a92b-4979-8cbc-306fda3fb53a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955548, "uuid": "6f53e67a-21fc-4d6e-ad21-82a684bd8f06", "value": "2cc911dd5282ee818f73f8f136f276f146b85e2b07d88a46af8bf9c93f8dc93b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176074ba-a191-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618893009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618893009, "uuid": "c7ec9ad0-7aad-4aa7-b040-9b4a5c0bc216", "comment": "Malware payload (Dridex)", "value": "0b75ac65a24428687bd866f7517582bc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618893009, "uuid": "6db36110-31b8-486e-8bbb-036f40789c73", "comment": "Malware payload (Dridex)", "value": "2d228ded156b6fb815a93faf09ccb9a699ec54693be50b22cd1a63d4133a1eec", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618893009, "uuid": "5f8a1877-450b-478f-a525-49b3ac5ce82a", "comment": "Malware payload (Dridex)", "value": "9fa1cbc5de86df849215a65bd63ac47c97cb8f00", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618893009, "uuid": "1f1ef96f-20fa-4464-92eb-1ac30ff81028", "comment": "Malware payload (Dridex)", "value": "7bba7bfbf1edb0eb400e252e445f232e8c87d7623016569d4add4c68a21ac1cd4311e97e0dd568a4e57c1d0c22305ed4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618893009, "uuid": "ba67801d-8cde-4128-90c2-64c7e418d71a", "value": "7AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618893009, "uuid": "fb38dc75-67f0-4fc1-96df-4a05f196f065", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618893009, "uuid": "842e47bf-ac73-4e55-8096-2d44d8232a8a", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618893009, "uuid": "5e99e6a8-cb5f-423f-bd79-b873b03c7d05", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618893009, "uuid": "fdc82398-0cdf-4ff1-a7c3-4ac440682b70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618893009, "uuid": "845b10db-73e4-47ba-8a66-69cc1783f4ae", "value": "2d228ded156b6fb815a93faf09ccb9a699ec54693be50b22cd1a63d4133a1eec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "725cc35d-a19d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618898316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898316, "uuid": "9b6aa077-b61e-4fe3-b4a9-ee4852d90e49", "comment": "Malware payload (AgentTesla)", "value": "1607a59b22f8628b8356f7c439cde5e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898316, "uuid": "d0961065-803a-467d-88cc-a319844f1df8", "comment": "Malware payload (AgentTesla)", "value": "2d62f999d1ee659961f0e661a0c2811c922d7d587a6d690e02619fbe8ddea0ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898316, "uuid": "06c55908-8b28-4b69-9eaa-906892c5ef9c", "comment": "Malware payload (AgentTesla)", "value": "c9cf528fe6594a838b26af4be36d849c6836674d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898316, "uuid": "3266a47c-c55d-4ee7-996c-c721c553515a", "comment": "Malware payload (AgentTesla)", "value": "948314aec5e45235ac5d5271a446f1fbea1a1108a025de148b466ef1a1e3577ad155a43087367d30c3f1c8523bf70df0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898316, "uuid": "5351b68e-7268-439b-a956-acabf8727409", "value": "7DC4BAACC08742D88F89ABB86B1F2F85114C7A6EF744A6337234977527E2C7B501697C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898316, "uuid": "72cfb262-5049-413a-b3a5-43178347e1f5", "value": "6144:D6YAmGLNloToFD9kW5M5sQL91+gb0B9b6clSrhus4U7h4hBjaYnompOcmjiGq7JE:G7eF5/4GMjvFGRKIy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618898316, "uuid": "d621fecd-283f-4faf-955b-77fd19679805", "value": 586272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618898316, "uuid": "125b1533-d502-4e8d-9d07-7823f944b19c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898316, "uuid": "666f1487-ed1a-49ff-9931-44d1cc2924a5", "value": "7789-2020.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c29cddfd-a1b6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618909188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618909188, "uuid": "3d1a9316-4198-4411-9b77-90dc7230f8e1", "comment": "Malware payload (Loki)", "value": "e89111fec44b3951e81e0e28a8d9716d", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618909188, "uuid": "dfb4445e-8766-42da-9461-dc7201cdb005", "comment": "Malware payload (Loki)", "value": "2d80bcb044726fdc77e7cde1667921ec707af42ad318f172265d19817d893a62", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618909188, "uuid": "d73eae9d-7594-40a7-8f10-044fcd9ebb54", "comment": "Malware payload (Loki)", "value": "1d0140d1afc4cbd86011fd2edab8772bd930a060", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618909188, "uuid": "f1016c0a-3d94-4716-bb04-f6da0d1f6fa4", "comment": "Malware payload (Loki)", "value": "7021ace113e9a0d815b863b5de4640d6ed2336977cd193854dd0149b42256e05b65df792362bedb69af2440f769c6e62", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618909188, "uuid": "bc41e5bb-2ff1-4b3a-9cf2-a5dc4d5b276d", "value": "46E4234ECE99346DBE54BC8C118E52D985A9C77E750418F2229FB1EAF00D0FB6E52292", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618909188, "uuid": "5ee0e671-dcb7-45db-ae80-7642b9d89960", "value": "12288:DH4jAd9he64nHu1NFUgyuIcdi1qRUgjeDFA1SkzDcO4ZurRSxPAAgT9o1:0WKNO1wgyutdNRU81Lp3cK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618909188, "uuid": "53267dd3-3239-4ccb-bb4e-877455327478", "value": 703133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618909188, "uuid": "4c59125f-85e5-4379-b97d-6b1d55010a5d", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618909188, "uuid": "df3ac77b-e60c-4574-aa83-c27a0891db4a", "value": "PEMBAYARAN COPY TT_PDF.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ffde404-a198-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618896004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618896004, "uuid": "506045ad-4651-4f0e-b3ff-b5df04687af1", "comment": "Malware payload (Dridex)", "value": "19b1dd96f2f6f040a3b6393321087d6b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618896004, "uuid": "bb03e0f2-5138-4f8f-a9f2-86464508e743", "comment": "Malware payload (Dridex)", "value": "2dbc777167809384780d6370f13721f49b27f18d4db7a0e4f2cf2bbd5fe98fc5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618896004, "uuid": "bcef3977-6c5a-495a-81a4-4ceb018ffcc2", "comment": "Malware payload (Dridex)", "value": "efa711f47ac03b75955bdd0d1e07ad2b31364f40", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618896004, "uuid": "7c912bf9-046b-4e07-a7c4-75294eec5af0", "comment": "Malware payload (Dridex)", "value": "a8c577f649c423c5096974d22c3ddc1130d87e78c0d859ef9e7e210c75a3b44a2eb50e37698fc1e7863688a3b75c608d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618896004, "uuid": "84965947-b63e-4ac7-a0a1-8d4ed137acc0", "value": "20F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618896004, "uuid": "669d869b-7eaf-4695-b003-d48560c70aaa", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618896004, "uuid": "9da69365-0248-47a0-95e1-2ee99e09aa50", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618896004, "uuid": "f88b5f28-b849-4b00-9f98-e3765b1bbdcd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618896004, "uuid": "5f6a77e9-4946-4b12-8052-9707740b7dc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618896004, "uuid": "e2bcfaba-1f7a-4beb-9ed5-4af33ffbb72a", "value": "2dbc777167809384780d6370f13721f49b27f18d4db7a0e4f2cf2bbd5fe98fc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efbb1c7-a1df-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618926496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618926496, "uuid": "fb43cfeb-29b1-407e-81e6-31f5cefdbd19", "comment": "Malware payload (Dridex)", "value": "7c5cc205b3e058532f6867b7f2598bb0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618926496, "uuid": "a61f28bc-f6da-48fd-8b39-71c741ae0526", "comment": "Malware payload (Dridex)", "value": "2dc1c82f766ee7fe2f09993fbd576903f0ec9d233228f17072d02377b4ad95c4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618926496, "uuid": "2857468f-3848-44e4-b723-9a806089cf29", "comment": "Malware payload (Dridex)", "value": "bcc4311577ed7e082e6a70e71e99e2102c146818", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618926496, "uuid": "5b0c0194-1888-4836-8735-96426d2ad486", "comment": "Malware payload (Dridex)", "value": "bb51d8b89555176fbbf3e16a2640b97502ca640b9ab9831f64277e872efa240ffab0811b238c2c1b111db3fd60f2f367", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618926496, "uuid": "7c79fc2e-e4a4-44c2-87ba-466a61c1567f", "value": "C3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618926496, "uuid": "32cb5dd2-d46c-46c0-a2e6-7735f4b0358f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618926496, "uuid": "e3b37e82-ba5c-41ca-a007-8d1b3d9ba6e5", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618926496, "uuid": "48314ad7-d43d-46c7-8a29-01fbcbedc92c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618926496, "uuid": "e7e00938-0f64-48a4-819e-6ffa509a3468", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618926496, "uuid": "dfdb6e7a-1ab8-460a-953e-da270435da00", "value": "2dc1c82f766ee7fe2f09993fbd576903f0ec9d233228f17072d02377b4ad95c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ddb97ab-a217-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618950546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950546, "uuid": "81441868-877e-4d47-abc2-eca79f5f8deb", "comment": "Malware payload (Dridex)", "value": "f836471a98b2e9084c327fad887341f7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950546, "uuid": "2e69ab98-69ac-4551-986e-5bbc8d11daa3", "comment": "Malware payload (Dridex)", "value": "2e11c3a2923655dd80f5080da4e66fbb4f311b4db60e0cdd5ad3f569b24452b6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950546, "uuid": "446fda10-91fc-451c-ac36-113b50f5a1ff", "comment": "Malware payload (Dridex)", "value": "b50487c2e692f15ce9c6e0b12f0f1409607ca020", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950546, "uuid": "a0818688-5721-4e04-8051-28684414cbf8", "comment": "Malware payload (Dridex)", "value": "2d67eeeeb25cd6119ffa1393fae8bd8f243a5a9f1dead27ceca6d0680ba16b6e6bd1c81e997e442dbd17adcfc9ecf220", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950546, "uuid": "e2504cde-b711-40ff-9d5d-41fb03569d65", "value": "D8F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950546, "uuid": "18bc6360-89bc-4c11-a855-77edecfc2272", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950546, "uuid": "2256f547-1876-4bc0-9197-9b143ed77149", "value": "3072:YwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:YwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618950546, "uuid": "795febf0-d255-4c30-ba32-cd6303b7bda4", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618950546, "uuid": "169eca4e-2b9b-439a-9c54-981c310647ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950546, "uuid": "664cfba3-c060-4c9b-8874-e2b3d575abed", "value": "2e11c3a2923655dd80f5080da4e66fbb4f311b4db60e0cdd5ad3f569b24452b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f586dc50-a217-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618950935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950935, "uuid": "643b32ff-368e-453d-9918-deb41799fefb", "comment": "Malware payload (Dridex)", "value": "d5780cbeb74bb5e95043654adbb66d55", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950935, "uuid": "4fa72d52-f97c-48f7-9fc5-af7b756ac704", "comment": "Malware payload (Dridex)", "value": "2e131626ee9e1cdd9245c9aa8923cc292f5f48a20020b0adb2585cec5ea8e46b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950935, "uuid": "2c6159f1-3c82-4322-b2d3-37298ebeb11b", "comment": "Malware payload (Dridex)", "value": "a9f6adb7c898062d865096273808366189634374", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950935, "uuid": "d507934d-75f2-4bab-9b34-3b3cf5537e8b", "comment": "Malware payload (Dridex)", "value": "a01acbaa453ab13015c853286aaa998494a43addb4c61f56c40f0269c6779ed4bef4a94d5bf99e75cc42dc5a3ad780f4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950935, "uuid": "5f94aeb5-89a4-430d-8b71-38278c472136", "value": "4EF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950935, "uuid": "1519fd3a-e94e-45cf-a96e-3a5f5acb1a7b", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950935, "uuid": "6aa736a8-b631-4779-8223-5b3cdd0409d6", "value": "3072:nwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:nwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618950935, "uuid": "253be586-554d-4c89-a24b-ce5eec51acc5", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618950935, "uuid": "75bde2cf-adc9-40e7-888b-9a7749d9c5e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950935, "uuid": "6d061bc4-8e4a-4661-a7f8-17e24cf79b1d", "value": "2e131626ee9e1cdd9245c9aa8923cc292f5f48a20020b0adb2585cec5ea8e46b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c3efc1-a20a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618944999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944999, "uuid": "ba6df4c7-ce45-4525-97e2-335106890e1b", "comment": "Malware payload", "value": "bc7e3daec294e37f4ea9ecb5dc8c1ddf", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944999, "uuid": "db683594-b219-480f-b599-30d9f0ec2cc4", "comment": "Malware payload", "value": "2e17fd839da0655fcc0b6c32ee1032f3e046ffd6425d18eaf720ac415a62f4d0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944999, "uuid": "f8cd1123-7aca-4033-8868-ad5be5ac2ecb", "comment": "Malware payload", "value": "3209d2cecf1c0c82131e863b9a633d42b8c2c3ae", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944999, "uuid": "61bde03b-5060-401d-a699-f8a438c115ea", "comment": "Malware payload", "value": "440ee5863a638771383b6c53ae51846055f2b3f759ef26459f1a80ffc867b1e28395ce676a39e71604b07962442789c3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944999, "uuid": "647e48ff-93d9-47b3-8cb8-0899b7c17e07", "value": "B9F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944999, "uuid": "aa66ecc1-a485-48d4-8f14-7043c54c78e9", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944999, "uuid": "7ae35760-4289-4af9-ac04-5643bf29da4b", "value": "3072:YwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:YwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618944999, "uuid": "8b0532c3-1653-4228-bb22-2a42899212fa", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618944999, "uuid": "8f591a23-9021-409f-a8cd-59e5b60cd3e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944999, "uuid": "5659f260-bf91-4fda-bbe1-9aeb12ac17f8", "value": "2e17fd839da0655fcc0b6c32ee1032f3e046ffd6425d18eaf720ac415a62f4d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76baeb96-a20a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618945139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945139, "uuid": "b8f59b64-59a6-4d07-a431-3686a7aa5797", "comment": "Malware payload (Dridex)", "value": "637883522f0369d48715862593a3718d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945139, "uuid": "dd0741a4-9d5e-4c89-83b1-a9b884805b6d", "comment": "Malware payload (Dridex)", "value": "2e5b808b64703b2d4c6ee2cff685f3e787871f117bc9cf4f5eb4b68a4eff7dcd", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945139, "uuid": "05349341-2450-45be-8ed5-cd0866db35b3", "comment": "Malware payload (Dridex)", "value": "b728079e46bf5da9cbe8d2074fd9865510877db1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945139, "uuid": "3fbe4330-606f-43ad-a482-717872c651b1", "comment": "Malware payload (Dridex)", "value": "17ddaf8a9343eba66422ce6028909729281c54b33ee4661b48024272005eb10e7d25d63115b2e037e9aab1e78d63ab9e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945139, "uuid": "51204213-761a-4e05-8e05-93a47e9dee11", "value": "B9F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945139, "uuid": "95d587c8-9ee6-4899-bd59-0a51f2edd722", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945139, "uuid": "377e1d70-6129-43c9-a746-c6ad86bb3b5f", "value": "3072:3wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:3wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618945139, "uuid": "3ad8a781-ea5b-4d21-86a7-154830e408ec", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618945139, "uuid": "27ae8f5b-194e-4e17-a5e2-83ab270d0a79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945139, "uuid": "75f8d4c4-fad1-47d1-8ef7-c44363a33bcd", "value": "2e5b808b64703b2d4c6ee2cff685f3e787871f117bc9cf4f5eb4b68a4eff7dcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82eb3f42-a209-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618944729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944729, "uuid": "16a98035-8706-40c9-ac4b-87b88b57b0c0", "comment": "Malware payload (Dridex)", "value": "d864a4f71c5e6a2a84857cbd8d2845be", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944729, "uuid": "3cdd1e29-935b-4c03-b76b-a25b708d27a3", "comment": "Malware payload (Dridex)", "value": "2e85d15d04dffe6b48d6b038632a3cb210d246735426f4a1342cf26be5c99b47", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944729, "uuid": "43b98749-4c97-4a84-b338-2b48614ae45b", "comment": "Malware payload (Dridex)", "value": "93af0830f077a8256e1960eb24b40b9d0d86a24f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944729, "uuid": "7072c701-d8dd-4829-b004-9be07e53cfba", "comment": "Malware payload (Dridex)", "value": "86813777e0f81331de3c83ee1ae61ddc67bbd95ae543254e995c3a3fb047647eb53fd882010c2ef720b6dabbbf5ae30c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944729, "uuid": "8f6a551b-b8ef-4a9f-8fb7-ebc781af7ede", "value": "8EF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944729, "uuid": "4c854f66-22d8-4bc1-8661-f44386268c36", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944729, "uuid": "3dfbce8d-cede-4b9d-97a8-1f9b7cd635ec", "value": "3072:PwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:PwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618944729, "uuid": "318b17d6-38a0-444f-a7b4-843cffb63c72", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618944729, "uuid": "1c86611e-28b4-48c1-b064-ef39eb7002e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944729, "uuid": "70e48634-7501-4ff2-b673-7f97f6f16b90", "value": "2e85d15d04dffe6b48d6b038632a3cb210d246735426f4a1342cf26be5c99b47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d6d8c6-a234-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618963124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618963124, "uuid": "67d9c113-949d-4e05-9bee-dd1d5f8d3824", "comment": "Malware payload (SnakeKeylogger)", "value": "f1bc072739f5165be1b19cac0f1bf6a7", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618963124, "uuid": "fa279c7b-38fe-410c-aef7-42edaee9d1d7", "comment": "Malware payload (SnakeKeylogger)", "value": "2ebcb775470fdd3ec74d4acd60b4e50e4eb832ea6c0ffe975998b9b6eecac032", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618963124, "uuid": "6651d29e-e179-4f36-9d81-950dd67e563a", "comment": "Malware payload (SnakeKeylogger)", "value": "d965f8ee29794aeff4c37a5f68ed1daf7c73fb90", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618963124, "uuid": "776d5c8c-f58f-4f26-bfb5-a031f9d1c26f", "comment": "Malware payload (SnakeKeylogger)", "value": "9fbffc6f253196ac3c3ebca11f0c3276de56337c149badeca33b16242aadcd1f1f518368a1dafadfec9d8634b595be82", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618963124, "uuid": "a5a542eb-c455-495f-bdb2-192cfb3a7f29", "value": "F005AE593A48F69FC81BCE36C9541C30A661A1A7D30BE707E05F12AC894D69BFF191F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618963124, "uuid": "5c63f026-c436-43cf-8e86-5c703f03c0fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618963124, "uuid": "e5dec6b7-0c99-4942-b1d6-8ddcbba0e74f", "value": "12288:B0aW4sfXADzdr3mCToKYig1Ap6644VoBNTRWAnekVIv/YxXh/uvgxcG5cKJmv/6M:BdsMxz/dk4l4jR/xyHYx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618963124, "uuid": "0aacec52-2d00-4327-be8f-5758c56e27e6", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618963124, "uuid": "4cdbb41f-e5e6-420d-b617-352cfd36fb5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618963124, "uuid": "eec93605-4d17-4f10-93f7-b24c9513e438", "value": "4600004505.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ad2727-a1e2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618927979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618927979, "uuid": "e9fa682d-2629-4d52-a5b1-401e0a0e1b1f", "comment": "Malware payload (Dridex)", "value": "9150a3b9101c318912d183c3c56e62f0", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618927979, "uuid": "f0ce53b7-76b4-4b4e-bc96-22ae6ce73c26", "comment": "Malware payload (Dridex)", "value": "2ec17c5a985c16390671e16e9b26131d8f8c3df50096e8bb5d68d28a6e9efe04", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618927979, "uuid": "ac0b2af5-325b-4338-802f-0729132b9c65", "comment": "Malware payload (Dridex)", "value": "bba4fd257163e9195ecf1fef7d12ee069e4a6df6", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618927979, "uuid": "dbbc15a1-53e0-4671-aab5-beaa1e936651", "comment": "Malware payload (Dridex)", "value": "bf81c32eccd432731fe26f58791c63a29eb9301bb1ec0664ac769dc42312ead21b95703c3a1ef5549353d20cc12b0551", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618927979, "uuid": "9d0b5e04-cd0e-4f28-a749-b7a4295dabb5", "value": "52F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618927979, "uuid": "70345043-449d-438e-a739-6810cd0a0558", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618927979, "uuid": "2b0af9e6-e3ce-44e5-a952-762cc2594966", "value": "3072:2WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:242IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618927979, "uuid": "e97ea58c-36c3-4f20-90e6-bf1f10414ec7", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618927979, "uuid": "87403e5b-891d-4b5d-bf92-7d076613ac6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618927979, "uuid": "8907b39f-ac44-403b-bb90-83e437976fd3", "value": "2ec17c5a985c16390671e16e9b26131d8f8c3df50096e8bb5d68d28a6e9efe04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa79755e-a229-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618958674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958674, "uuid": "5a7a17a2-3cd2-4bad-b982-a61bb9035f1c", "comment": "Malware payload (Dridex)", "value": "ad27783d4db80c22b0611c3deb8981c8", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958674, "uuid": "9d37d43a-91cb-4f48-8005-da0a455118dd", "comment": "Malware payload (Dridex)", "value": "2ed01e25de0d0b9254c25deed1329959f410780a300772beaad5db584dad2655", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958674, "uuid": "d4517afb-c1ad-48ea-a83e-843350b4b267", "comment": "Malware payload (Dridex)", "value": "506e639a835fcf845535ddd142fe91265b5886b2", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958674, "uuid": "b1912b28-f97c-47e2-9d21-482515cff9da", "comment": "Malware payload (Dridex)", "value": "7e2b76f01ef61ac42e63879040f3382ae03e698102e69c05493d1a47f71531f32f4639c6566bdedd9ad545baa898a09c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958674, "uuid": "b0a8654f-ca8c-46e5-bba7-de405449ad4a", "value": "23F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958674, "uuid": "1000f24e-30bf-4dcf-9a79-6bb674c9ebce", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958674, "uuid": "484c4a2f-cc68-4717-b0a7-57c17e7a854c", "value": "3072:Flpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Flo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618958674, "uuid": "da76ccea-5a0b-4e00-81a5-cd12672a9bb1", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618958674, "uuid": "7ee8eb05-117a-4fe3-9fca-a622199de3ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958674, "uuid": "7dc9bf63-7169-4c71-8829-871d76d8b3ab", "value": "2ed01e25de0d0b9254c25deed1329959f410780a300772beaad5db584dad2655", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51a51fb-a1b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618907850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618907850, "uuid": "6b98352a-ad4d-4360-a95e-891a3d3aa8ca", "comment": "Malware payload (Dridex)", "value": "cb419d7231079298510d3e83f3cede46", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618907850, "uuid": "25831a45-f81b-4283-82bd-a2be6717e652", "comment": "Malware payload (Dridex)", "value": "2ef90e544d45ada95edfc307a10f18a9caa60290e790174f5047022cf145146d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618907850, "uuid": "ab6fd130-ac5a-48cc-956b-021711e8c75c", "comment": "Malware payload (Dridex)", "value": "a2e8b82ca4ad3f9aac96e50c79d572f96b07fc2d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618907850, "uuid": "43328466-4ea2-4e16-a78e-58723a5ce6e0", "comment": "Malware payload (Dridex)", "value": "fc9a312de16b10bf467dab85d79b2471291319b10883c7ab2535c3f1c3b87352664ba21add41f34f0b8ab92593e780e0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618907850, "uuid": "d677d73f-0d34-4f89-a81e-900fce7bde32", "value": "BDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618907850, "uuid": "08be60ff-5271-4137-98cb-741be620bd03", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618907850, "uuid": "ec6c6174-1f6b-40cb-bc3d-14169f96e200", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618907850, "uuid": "685a1490-4f93-468c-94a6-5f6ec1af86a4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618907850, "uuid": "a6ea586e-905d-4c0d-afa2-4891897ac78f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618907850, "uuid": "829489ae-e3d9-4167-ba3b-7650377de0ed", "value": "2ef90e544d45ada95edfc307a10f18a9caa60290e790174f5047022cf145146d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c392ee-a229-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618958351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958351, "uuid": "1480c199-1cf9-4aeb-9355-024cb357b636", "comment": "Malware payload", "value": "9f1a2b3a74ee5ea477ae92be102bbfe1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958351, "uuid": "4c482f92-3b46-4241-b145-1628204df5e8", "comment": "Malware payload", "value": "2efb0e57a72264c085689dc3fbf79c8a7d7287937e26d0cddc6323158e5ef9a8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958351, "uuid": "a0189b51-1928-4e82-a632-ecdc5af4cf2d", "comment": "Malware payload", "value": "b4ce1ca614cdc4dd6608649349b99a6547846483", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958351, "uuid": "e524c9dd-a1fb-47f1-9989-b9f34711adb7", "comment": "Malware payload", "value": "c8aaf0649296c044cd383a94af530a123dbd86617c9594a37c15d031ed1c3f5252720660a61544dd64a59c7f97396070", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958351, "uuid": "b6861111-5f02-4bb2-af35-0f7714f7d534", "value": "EEF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958351, "uuid": "75436f48-5e48-49fe-8053-b28c5c24c048", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958351, "uuid": "ad452c82-74c7-4350-aca7-d0bcc13cd822", "value": "3072:DwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:DwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618958351, "uuid": "80531aab-91f9-4c6e-97fe-3fdd1d59e285", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618958351, "uuid": "0c7dafcf-35da-413d-812b-5cbd3a3faeeb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958351, "uuid": "7159ccdb-d879-4030-8da7-fbf049809284", "value": "2efb0e57a72264c085689dc3fbf79c8a7d7287937e26d0cddc6323158e5ef9a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d2c361-a174-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618880746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618880746, "uuid": "0f254027-2f4c-4e00-8859-04cb5e68d184", "comment": "Malware payload (Dridex)", "value": "82f3567799d8f89bf81b86129a06413c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618880746, "uuid": "4c1551fc-2875-4faa-85c1-5f2df258f454", "comment": "Malware payload (Dridex)", "value": "2f0b03e4516e9450e1f5c47f4539d0c8d90a8f52938e4fd11392ccef635bde39", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618880746, "uuid": "bd76584c-e482-4b03-b375-ba549166759b", "comment": "Malware payload (Dridex)", "value": "b880d20af3a335853e273cfb2bc14a18028b8803", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618880746, "uuid": "5a6dad4f-c378-4f71-b0b7-cc015df7f2d6", "comment": "Malware payload (Dridex)", "value": "f1933ec0dab406b53a6098e1c524f13491a165c903e82d2c690a656275bb87f07e51b0d8307912e55ebbe906c40a1369", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618880746, "uuid": "91508377-696f-4cd1-93b6-f0cf2dd8b3ce", "value": "93F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618880746, "uuid": "cb72e99d-9ec3-4e37-9397-2c82e8604bea", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618880746, "uuid": "86def378-fac8-4dbc-a2f7-88d67e9418d3", "value": "3072:YwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:YwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618880746, "uuid": "bb041794-261e-4cf1-95d0-8d6b15a863e6", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618880746, "uuid": "4b8923ca-d428-4b23-9b3e-28c6dc95668a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618880746, "uuid": "9625f4a1-a67b-4178-ab91-ae589246f8cf", "value": "2f0b03e4516e9450e1f5c47f4539d0c8d90a8f52938e4fd11392ccef635bde39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4b242c-a210-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618947644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947644, "uuid": "69081f53-125c-4b2a-9974-3a26b8e401bf", "comment": "Malware payload (Dridex)", "value": "78b562fa518dae4049b85575d86449dc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947644, "uuid": "bb2f5161-8faf-49cb-9b56-6beaa96523d3", "comment": "Malware payload (Dridex)", "value": "2f2959aa84e673cd013250b6e3bd8ad9cb44452aef2591018a0c1ecb982b4b41", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947644, "uuid": "c46e67e6-e38c-4443-a0dd-b748935826be", "comment": "Malware payload (Dridex)", "value": "e8d6481540d5ef6a055b6ee21d5a1847d8fe7870", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947644, "uuid": "b6133e16-ae2f-49c8-a00a-9eaa3bd795c1", "comment": "Malware payload (Dridex)", "value": "ecaf5bafc991077beab3333018074ff09b3f8ad653999e403d82b7a5be3855631674e9c23daafe92b5e5c56a44b2c220", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947644, "uuid": "64654292-9e61-4fcd-88b9-4713bb1a9b43", "value": "76F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947644, "uuid": "c4a29807-ebae-42c6-a572-a83f830e3cf5", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947644, "uuid": "5eaeb68a-5591-4bbd-a7f3-70b38fbd49b9", "value": "3072:7wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:7wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618947644, "uuid": "e6e854e6-0e20-4f17-a990-4d4059246dce", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618947644, "uuid": "8183dee4-a19d-43ae-9a60-6480df466c59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947644, "uuid": "c4836378-33ca-48da-b0d1-6e9a1a5f756d", "value": "2f2959aa84e673cd013250b6e3bd8ad9cb44452aef2591018a0c1ecb982b4b41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4b5668-a20c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618946039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946039, "uuid": "ae376ec9-f44c-48fe-8665-2e6a73717f64", "comment": "Malware payload (Dridex)", "value": "2f78bc9d10ac1e52957f1bdcec81d6fe", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946039, "uuid": "43a0c7e9-704d-4dd3-b8c3-c2af1c5b88e7", "comment": "Malware payload (Dridex)", "value": "2f50a5cd4d667abb77b7840f086d01b1c71c453332e6c0fed6851b384ca08e1d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946039, "uuid": "07ff866e-88f9-4ea4-ac17-bbe93547e5d5", "comment": "Malware payload (Dridex)", "value": "260b74f6ce5b20d970f8c4f036e8768e366a511e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946039, "uuid": "5a146f6d-8baf-4d97-829a-8933fb71a001", "comment": "Malware payload (Dridex)", "value": "fe50c869709e67174abf0042497bf081076e08ee5b8d3fbadb9061ba29d3c55fa18ae2b2a98471f12956cc57e163346a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946039, "uuid": "2bd1a0a1-b885-457b-8bbd-491ec5e8bc57", "value": "C0F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946039, "uuid": "74d278fe-bafe-44f0-8090-70e3fb33dcd2", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946039, "uuid": "f39c4c72-58de-4324-b5f1-de597cfa75b5", "value": "3072:bwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:bwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618946039, "uuid": "309dbaae-e84b-44b7-b5ac-83d17ca82230", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618946039, "uuid": "6b22a6c4-9378-4171-8307-bfe33d661916", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946039, "uuid": "f64eaf8f-af06-418a-8a79-706ad2270abe", "value": "2f50a5cd4d667abb77b7840f086d01b1c71c453332e6c0fed6851b384ca08e1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80aa8015-a21c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618952886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952886, "uuid": "e03e3509-4bc9-4a24-b5cc-0f6a4ac3f747", "comment": "Malware payload (Dridex)", "value": "2ba92c79d57e52c20a8cc8f403cf635a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952886, "uuid": "954eef65-d7fa-4c98-9535-71cdba49a9c9", "comment": "Malware payload (Dridex)", "value": "2f66be35326bfdf49c01f376b7714b01bf3bb33f70d260cefec82dc2cfd59146", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952886, "uuid": "d27b511e-e309-40cc-b3a3-e8c45f5a271f", "comment": "Malware payload (Dridex)", "value": "e5eaad9846c20f907fa01e57541329a7f7d5a361", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952886, "uuid": "0d82b22b-76c4-416b-a2de-4614b0e0d2f6", "comment": "Malware payload (Dridex)", "value": "bcfb690f43b35cc912bad2848e2ebbbf31fb6d30482d553bb65b651819cc6123e9a95541c1e944c3f63c0eed75787ed8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952886, "uuid": "0e0a5480-7705-4cf5-a355-04748744b0bf", "value": "F2F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952886, "uuid": "97470c17-154a-407b-8bd6-4585f9d38930", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952886, "uuid": "1f9dd872-38e6-44b0-b6ad-cb9575d8393c", "value": "3072:7wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:7wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618952886, "uuid": "f777f7b2-7c4b-4e64-9a78-e2b45200139f", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618952886, "uuid": "f7aa094f-3e9c-49e0-9490-6d205ad01c7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952886, "uuid": "f41d46df-8ea9-4582-8c9a-05e95847bc8e", "value": "2f66be35326bfdf49c01f376b7714b01bf3bb33f70d260cefec82dc2cfd59146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f3d929-a16c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618877173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877173, "uuid": "ca8b99ac-d896-4141-95de-af2771a9c0ac", "comment": "Malware payload (Dridex)", "value": "b2808000f84971b8abfe9111635c2261", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877173, "uuid": "5c3d273f-e9d7-497d-bf66-edf6a88c2e10", "comment": "Malware payload (Dridex)", "value": "2fa6ac79f920918d518a1441f55abc8484f4d9953f5d96a33b30636d729fda60", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877173, "uuid": "62db4b11-120a-497d-9df3-5e5cbb4b4e69", "comment": "Malware payload (Dridex)", "value": "8c0c6db74ec21a4da21e3216b6ae48071ae4f7b1", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877173, "uuid": "c3ce3dd1-71e2-444a-be2b-15ab44062bf9", "comment": "Malware payload (Dridex)", "value": "12e62af06adf46e31df359abd97c83a75d1948d575e38af3f15814327410ec0efd8aebbb6d814652acf9d7615068364a", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877173, "uuid": "828314ca-6cd3-452d-9ba1-fbdadb65c722", "value": "31F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877173, "uuid": "588685f1-cf63-4f51-ac7b-d8d1b257060f", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877173, "uuid": "d4cff2bc-c978-447f-840b-065ca4b515e9", "value": "3072:fWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:f42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618877173, "uuid": "f4db7977-24e7-4bee-bb28-06dc92703991", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618877173, "uuid": "4b53138b-a532-4ea1-bab1-e4052256c0e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877173, "uuid": "de089421-b8dd-421e-99d2-0136e40f5e28", "value": "2fa6ac79f920918d518a1441f55abc8484f4d9953f5d96a33b30636d729fda60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de756036-a222-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618955620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955620, "uuid": "57488dae-ae6e-427e-a164-42a236d570cc", "comment": "Malware payload", "value": "01ef970a3e1d0ad3e501df575f1e3d1d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955620, "uuid": "6ea77a06-c6c0-4e8b-abd3-71f0b7c39fe2", "comment": "Malware payload", "value": "2ff1ba85119e58f24ecef18c1fe24c89580e735d794d2bf039841ad98e43f3b1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955620, "uuid": "94907091-7787-43ea-81b8-f1d4129f36fa", "comment": "Malware payload", "value": "f3571e86d68fbb1db433e0bf10b2d099fc3cd3dd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955620, "uuid": "c04576b5-0c60-4d23-96d1-9d57b429393c", "comment": "Malware payload", "value": "b7a3b9ea73b71e95a73650fba7bcf545d13d62c67ded3f1fe725f966839c847d64275a43f14a9c223fe37f076115b391", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955620, "uuid": "8a80118a-d0af-4edc-b88d-cbd4b5e8124d", "value": "7FF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955620, "uuid": "182f9b62-fa81-4641-9338-3f6d4e17c573", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955620, "uuid": "124ad399-18bc-499d-a12f-b39194fddc53", "value": "3072:TwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:TwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618955620, "uuid": "7b8603db-32e9-4c90-bc69-c3a0eb55b54b", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618955620, "uuid": "06cf4614-1356-4c21-b362-40a116f6f908", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955620, "uuid": "21560803-2cd2-466a-9119-4863814b42ed", "value": "2ff1ba85119e58f24ecef18c1fe24c89580e735d794d2bf039841ad98e43f3b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e72712-a216-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618950486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950486, "uuid": "99f668fd-4f90-441b-8f60-7f9be40eac8c", "comment": "Malware payload (Dridex)", "value": "812348568813c4dfe3340d908b85c9c7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950486, "uuid": "594f3647-f332-465f-98ac-52d91c5112ca", "comment": "Malware payload (Dridex)", "value": "2ffac917f11ee47b96300f1f3df78b218358fe23e9699be9ac2f09b482ccd5b3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950486, "uuid": "d693165e-118e-4886-ac4d-831c32ca5327", "comment": "Malware payload (Dridex)", "value": "a9f6d0d4eeb4575858f040e575478f8441f5687b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950486, "uuid": "471a9c5b-d5eb-4c3c-a5e1-adcb8dbf67b7", "comment": "Malware payload (Dridex)", "value": "2db24609c5c3153b98c2bab8df98cb75be5339dc243de43260965f27198a665ac31ca68bcc31f03c85756e09f4809b16", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950486, "uuid": "4037abbd-2f3f-4865-a770-24fcd68eb305", "value": "7EF3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950486, "uuid": "47b34be3-fbf5-4f2f-ab85-88b3053630dc", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950486, "uuid": "3b70855d-92bc-4059-8ab0-e8e7368ed830", "value": "3072:EwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:EwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618950486, "uuid": "ce5784f8-4001-4218-8f8b-5982da9b7e9d", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618950486, "uuid": "9f618174-cadc-4e72-90ba-5d6144ae9b20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950486, "uuid": "f2a63a55-f258-4d44-9921-c2948b815db0", "value": "2ffac917f11ee47b96300f1f3df78b218358fe23e9699be9ac2f09b482ccd5b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0de30e-a19b-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1618897282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897282, "uuid": "62b219ae-f9a0-41cf-bb02-f50e2a50c674", "comment": "Malware payload (GuLoader)", "value": "6d3c072c538077cff7834e7dc292c14e", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897282, "uuid": "d2522ce4-9786-4b7e-9c97-d4f48c5675ac", "comment": "Malware payload (GuLoader)", "value": "30090fe5bff7d14b70e812fe8cbec7d1a170f8737eb93f38a2e66bb615f3acd2", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897282, "uuid": "1709c2e9-73bf-4e3d-9411-69013080ee7a", "comment": "Malware payload (GuLoader)", "value": "7a73ca2f958fbfeeddac994e052a296ceee597d2", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897282, "uuid": "7d1a4f03-4761-4060-9072-a19df9372411", "comment": "Malware payload (GuLoader)", "value": "09f31bba6e55d160516b75047bcdb6e4e9e5f4655fbbbc64a4d616bfca6c2f61a346a0662eeeec94cf774a6f9bc63663", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897282, "uuid": "84883f63-6f9b-4eaa-bfdb-be2cebd54528", "value": "6343029E0786350F5B00C0F45D6A1B1BC46C4D67745A4A9F7847AD0FAF74188E72E2C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897282, "uuid": "2fb40dc7-80ba-47e9-8a8a-2e851bcde37e", "value": "1536:SMZXYrVJQCZivay6txcGzw3zUMOJ/ju9INLsy7Eks7BO:SNBJQ2S6tfoUMOw9IRsyNsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618897282, "uuid": "606a6046-5a6d-4db7-b189-5065094c1cdb", "value": 59943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618897282, "uuid": "f910d3f6-4558-49b4-940e-3c39d19ca71d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897282, "uuid": "99aca7fe-bd4a-4167-a5d9-fd697d0e8c30", "value": "visceralgiafis.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c2bada-a1ce-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1618919468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919468, "uuid": "59d58a32-811e-45e3-b347-639b45e1169b", "comment": "Malware payload (RedLineStealer)", "value": "954b39f45379c530b7f659d697c29ac7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919468, "uuid": "7a4bab3c-fb81-4a46-a5a1-bfc8a0d91e0b", "comment": "Malware payload (RedLineStealer)", "value": "301a510700f2ebccd25fc5cc6c579ead2196b957ed81aa3eda29c7bc40887c26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919468, "uuid": "b7400f6c-febb-41c8-8659-1e44b21a6eab", "comment": "Malware payload (RedLineStealer)", "value": "9fa7dcb754041cc878f6ca3a71581a04e3b23427", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919468, "uuid": "19189c9c-508d-4989-b67d-1623313a7af2", "comment": "Malware payload (RedLineStealer)", "value": "ab033a5018a44bad70597022bab22abc5fd6b6dd462da85465a188bcaf3d31e085cd9f2837d302385789e85e9a49fbdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919468, "uuid": "ee14b98b-73eb-4ca9-8541-507c6358b590", "value": "BEB49E73BB216921C81A6E72DD25A42C033EDD3135E7C77232FAB1DDC426A41F8B4A59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919468, "uuid": "b4040445-3fe5-4372-92cc-9f0ae68593c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919468, "uuid": "4be5aa7b-2e60-44a9-ad8c-9c527c0cecff", "value": "6144:o0Rpkpk+ydDJtxKaewX7n1OpzawPShbGZCbW7JYfU8653:D5lL+onmcW78653", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618919468, "uuid": "ce4e9d9e-96a8-4d1e-b4c3-d521eb201e9d", "value": 499520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618919468, "uuid": "85a07bde-7dc2-4917-bb94-86c3ee33c942", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919468, "uuid": "69fcf1c3-31a3-4dee-bf2a-28bfde44be08", "value": "954b39f45379c530b7f659d697c29ac7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b03d39b-a21c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618952689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952689, "uuid": "035a2faf-8a3a-4607-83c4-8647a252cb87", "comment": "Malware payload (Dridex)", "value": "8bab9d83b8307369f4ea92247de12c88", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952689, "uuid": "9c3fd85c-7321-41c8-b869-510a77824be5", "comment": "Malware payload (Dridex)", "value": "305beda6146ae2f0596cc3b37247f3779bd9e9ff2d99db5c2f54823960617703", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952689, "uuid": "1f2b9251-44fe-4c9c-bd5b-46d66db08310", "comment": "Malware payload (Dridex)", "value": "3d2f8851463989037a2bff67c5b472b915fa586e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952689, "uuid": "88d11619-ea56-43e0-8918-5787438385c6", "comment": "Malware payload (Dridex)", "value": "6a10fd1f959ffd1f0b5ce5780e9e3354f1a9000d3f0762dccfb4514963b34745dfd816bd13aa0847f4064e26f4748799", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952689, "uuid": "f36e36b0-6f59-4e73-b141-658bfda12440", "value": "8CF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952689, "uuid": "dab6a561-d2e6-48e8-9d99-fefbd0b161fb", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952689, "uuid": "e069384e-51ff-4f5f-bffd-aa30e7fec7fe", "value": "3072:QwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:QwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618952689, "uuid": "e33ae7d7-3899-4a28-b728-01511c8f3941", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618952689, "uuid": "0d8359be-1fe3-436a-92e6-1ee19705080a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952689, "uuid": "51101871-a2b9-453b-8ab4-137202d5c6c4", "value": "305beda6146ae2f0596cc3b37247f3779bd9e9ff2d99db5c2f54823960617703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841fc98f-a1dc-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1618925404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618925404, "uuid": "87dbf5a8-1b60-4a80-9c41-e91540d164a9", "comment": "Malware payload (STRRAT)", "value": "947411b1a4e133d272be84cb789f0f18", "object_relation": "md5", "Tag": [ { "name": "StRat", "colour": "#2D639B", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618925404, "uuid": "f05bd9c6-dd99-4f77-ae79-e089d1a07cce", "comment": "Malware payload (STRRAT)", "value": "305c943edc6a19014d64ad5d8709ca362e6289b0acba244eb833da08f96214d7", "object_relation": "sha256", "Tag": [ { "name": "StRat", "colour": "#2D639B", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618925404, "uuid": "642c33d0-b393-4b36-be56-88915b7dde03", "comment": "Malware payload (STRRAT)", "value": "09e3acd8023faa33c3eef406ab5bbbc02062f3ce", "object_relation": "sha1", "Tag": [ { "name": "StRat", "colour": "#2D639B", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618925404, "uuid": "955ba187-4c0a-4fd6-a864-aca408a52414", "comment": "Malware payload (STRRAT)", "value": "81b0853fddc94d0a6a71ad3605eed588b94ea0f5910ee2bab40a6194927891872f915439f82b9a92d71fc2e54db1883e", "object_relation": "sha3-384", "Tag": [ { "name": "StRat", "colour": "#2D639B", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618925404, "uuid": "be310fff-aee2-43c8-804b-57b8f03efd62", "value": "10F4E8C65568390697B3E525C712A223EC39FA232C8729D67DC07E0E6FB6C445DBDE20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618925404, "uuid": "c4eba8a6-90a9-4d70-82f0-e8f52206f340", "value": "6144:+grvJi3wvBdfzS4qXFY/Lr23Fr5NTDhNIYeODeKZVt4yn6dLQ2c4pq699lWZKjv8:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618925404, "uuid": "901abae1-8360-4b3e-be85-69a97b1a3eae", "value": 737758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618925404, "uuid": "ad568dc6-5039-4399-a846-f70e49dd0607", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618925404, "uuid": "7bb742f7-0d3a-4d0b-a38f-883377180608", "value": "Scanned-Doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870b68b8-a1ce-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1618919396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919396, "uuid": "b5737d84-9447-4bc9-8087-74497fb46e27", "comment": "Malware payload (RedLineStealer)", "value": "6c24cde9ec513b70ef929bbd173b7a94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919396, "uuid": "ce407cc1-b713-4e8e-af86-3a1e1e02dd40", "comment": "Malware payload (RedLineStealer)", "value": "308087aed8b1e2e06ca043977cbbf86dfa5616ab76cd2a7b9a1ae48b747767aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919396, "uuid": "04e5d63a-1bc1-4b6d-ace2-0fcad4c43bab", "comment": "Malware payload (RedLineStealer)", "value": "211101177e6a826a912ce927b85962ec5d427ecf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919396, "uuid": "8cd4000b-47cd-4795-9f81-9abd60cd3117", "comment": "Malware payload (RedLineStealer)", "value": "0efef42af6cb8e990e5be7e123b9e7025939a7132cd83751706ea906e74ca9ce9fbd71952a8f358034ea19e3f2686923", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919396, "uuid": "ef481c0d-ade8-4e11-be46-055b5bda9946", "value": "B445337740CAA14FF2A3A3BE54E1D45F9875A1CB1543ACB6D1B4DCC1E8283F670790AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919396, "uuid": "b6da9072-c710-4161-8566-823c5fbbf696", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919396, "uuid": "ca558e00-0f70-4fb7-b206-7e3681a43fba", "value": "24576:MqwrpwLPnoEr4v/ORH+6ckiJAWQQeNwxqm8p4KjdE951w:Mqdnz0v/ORH3cxfr8p4Kj4Lw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618919396, "uuid": "cecbb62a-6ad7-4ddd-b804-e80906d222d4", "value": 1187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618919396, "uuid": "d1ca5f66-fe9f-40af-b3a5-45e0de457eb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919396, "uuid": "2d29b518-647c-4e6c-9bc7-94693abb002e", "value": "6c24cde9ec513b70ef929bbd173b7a94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04bbbe8e-a1c8-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618916600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916600, "uuid": "f7b3cebe-b0af-4d35-a907-aa63e86d4961", "comment": "Malware payload (RemcosRAT)", "value": "21149af0bb08bd872471807644ea8c87", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916600, "uuid": "72a1db20-8cbe-4398-9620-d839ad62f8e7", "comment": "Malware payload (RemcosRAT)", "value": "30a033122c088c30e0b104040955d3aa0d5c83d1bb25888c83478cab751da97e", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916600, "uuid": "546eff7b-9ed9-4d85-b740-de12c2081d68", "comment": "Malware payload (RemcosRAT)", "value": "619fd09d7c9f17912199efef32500c75ae276232", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916600, "uuid": "5e9ccee8-5c51-4cd2-8da2-c06d368be2e5", "comment": "Malware payload (RemcosRAT)", "value": "36151d670ed3debd791932ddcd1e9f5445bc3d6d5bc9244f55c10b9b21358141fecb1cdd847809923128abf26748dc78", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916600, "uuid": "5c3e698b-927f-421d-aa97-4bc467e5aaf5", "value": "A95412167BA8ED77CC2012710AB5961ADFA7E42961F11F03BB1CA615FF271C3991E342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916600, "uuid": "e91c05cc-4a2c-4ab1-84d5-762e8e602492", "value": "6144:BYYQVgs7+2lvrh42oKzUos8jnF63jwKm:sqiJvV0/os87Fmjwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618916600, "uuid": "34409f6e-767e-476f-ab26-e998966516b2", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618916600, "uuid": "03be6ac9-400d-4ba4-9c8f-ba7584098ccb", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916600, "uuid": "499975cc-161f-4688-9872-3dcefbdff62c", "value": "CONTRACT FB20172837,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df637f1f-a211-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948321, "uuid": "d932f319-1ee8-4be6-96f3-e5f53edbb61a", "comment": "Malware payload (Dridex)", "value": "ab3b217a76ae5bde876d0b9a5f0702ba", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948321, "uuid": "b60bebf8-6257-431e-b0ad-0b9415df4318", "comment": "Malware payload (Dridex)", "value": "30bbc55d0386037731fce63a4a34c7647c3741f3b6ac987bab653f9e054501bd", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948321, "uuid": "d4b3ff8c-8778-46ae-bc07-a0adacb532d0", "comment": "Malware payload (Dridex)", "value": "97a46b94e59ea6d75c449b3cbc205b50cff43599", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948321, "uuid": "72006add-eed2-42e3-a241-29b78666b8e3", "comment": "Malware payload (Dridex)", "value": "71bf0d8800a203a99381cec99c91084db57a55561e0618a6562f3f6bd8831753c3047e72bb8c56434b059ec95be17d60", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948321, "uuid": "a7b8d2b4-2949-4416-b7e2-17e386f2993e", "value": "65F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948321, "uuid": "716c0f51-e0be-49ae-8490-be9cafe150a3", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948321, "uuid": "953f7c17-a780-4825-abc6-48723f68dd4f", "value": "3072:NwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:NwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948321, "uuid": "0dc3ecae-5520-4b50-93bf-c20592c6eeec", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948321, "uuid": "8b1570e5-abf0-4297-8184-e3889e9043ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948321, "uuid": "97057474-e625-4e97-9eac-39b90b11b37b", "value": "30bbc55d0386037731fce63a4a34c7647c3741f3b6ac987bab653f9e054501bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e5e844-a228-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618958081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958081, "uuid": "28adf327-a225-4b3b-8ea4-cbfa739c8e06", "comment": "Malware payload", "value": "5ef49f185ebd973be34ce01191b294d0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958081, "uuid": "32d0aade-99c6-4627-973d-9a4aab13e585", "comment": "Malware payload", "value": "30d40bd87fed35394b50ae70cfb946300866178df3017c374691062d6ec3a08a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958081, "uuid": "26a39fa9-9971-45b7-ba77-f6acec6a4f80", "comment": "Malware payload", "value": "bf92e057d693f826edad5c417c8944059303e897", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958081, "uuid": "1fd4dce3-3bfe-4166-bb3a-8ec0c3d8a6cd", "comment": "Malware payload", "value": "11f964f5b3195d39c6583c2b5339db9165f9067b8d40f6e8fd27c9fdb1aa8234c96d223160b89d9f27b04a1c99305069", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958081, "uuid": "629f3d13-02db-4c4e-9770-c6d2c88df8d1", "value": "0CF3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958081, "uuid": "6d24389e-4168-4d14-924b-2251f8315ed5", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958081, "uuid": "3990f361-4513-414c-81c0-7dfb0c092f10", "value": "3072:twZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:twZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618958081, "uuid": "71960fb3-90d2-4cb6-9bc8-42568c12b73e", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618958081, "uuid": "de6ed6dd-b6bb-4b49-97f3-3fc3c2ac5e69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958081, "uuid": "ea546ca4-3a4a-4f5a-b2ab-ce9f96f0615d", "value": "30d40bd87fed35394b50ae70cfb946300866178df3017c374691062d6ec3a08a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59bc2485-a210-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618947667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947667, "uuid": "8ba1cf1b-d6a6-4984-a0b2-3fc620ca24c7", "comment": "Malware payload (Dridex)", "value": "66724aa9e7aa283f616d29342e34934c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947667, "uuid": "138210e8-561a-4ea8-aae9-707b9ed815c3", "comment": "Malware payload (Dridex)", "value": "312f35413c1a63c343db0a6ba69eb58b38948fb9bc8615a9c2bde07f98405070", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947667, "uuid": "0bd3a6d9-9367-4a79-a464-552f409a0ee2", "comment": "Malware payload (Dridex)", "value": "e4d0ea382033d7d1593f8ebcebdc53497833de3a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947667, "uuid": "7e62428f-fee0-4fb1-83fd-9b5282c0520d", "comment": "Malware payload (Dridex)", "value": "814034491d85d7a81f43c1cca516f76cb4e24760e05e52a8a516383512ff09564d1438dd4087bf493fb46a561de8b68d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947667, "uuid": "5666f6d1-2779-4321-a91d-0740060375d9", "value": "36F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947667, "uuid": "d0e02372-2564-4421-9a31-dea04fd267f8", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947667, "uuid": "c7f76311-2b33-489a-80c7-77287458a60c", "value": "3072:NwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:NwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618947667, "uuid": "3df089c7-17e2-475f-9ddc-05eedc18394e", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618947667, "uuid": "1b8166e6-f142-4ac3-96ac-d858384eff68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947667, "uuid": "9ef08cdc-4965-4f2c-ac58-f68b56a3e92d", "value": "312f35413c1a63c343db0a6ba69eb58b38948fb9bc8615a9c2bde07f98405070", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11326735-a1f5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618935949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618935949, "uuid": "ddf4a45a-18a3-4e6d-afb4-f1e85ea6b20b", "comment": "Malware payload (Dridex)", "value": "a2b403c3318de6ab23b9d0467e227660", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618935949, "uuid": "f158d7b0-c69f-49f6-adb9-1cd59f426722", "comment": "Malware payload (Dridex)", "value": "31461ed819a869e9a73657affb94a29741fa47df0c5ea9f57aa295bd89aacdc2", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618935949, "uuid": "12889669-8bf8-4c66-8f91-9fe9cbe46b9c", "comment": "Malware payload (Dridex)", "value": "d9adc94396211a9fbf9a2ec114e0c71a95ea7cf6", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618935949, "uuid": "ba3cc5a7-c6a0-44a4-ab01-0d1ac374a4ad", "comment": "Malware payload (Dridex)", "value": "7d7c10c7a0f2f4e163dc415ca84f093c6cd2a032deae58e94db2b72500a04ab7f1d64b8448f6faf5c027261256e479b4", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618935949, "uuid": "d3440a1b-131c-437b-ac75-45ccaf105f8f", "value": "68F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618935949, "uuid": "4dbb6c38-ba40-41e6-a068-77ce8fa974e3", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618935949, "uuid": "011bc6d0-1eb9-4c08-981a-7a3b3f958d99", "value": "3072:PWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:P42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618935949, "uuid": "9fdf9806-63a8-43ec-88c4-d15131655f1f", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618935949, "uuid": "1ab5c03c-f428-4596-a5f0-c0ed7f917fe6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618935949, "uuid": "434332df-b13f-4725-bf5f-f9e5f5b4a89c", "value": "31461ed819a869e9a73657affb94a29741fa47df0c5ea9f57aa295bd89aacdc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10bf712-a1ff-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618940512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940512, "uuid": "5f0afe53-250a-465f-b1ae-4a157cd5775b", "comment": "Malware payload (Dridex)", "value": "2192f81558e30598b3f646f94aa118f8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940512, "uuid": "00e34b83-13d6-4b5b-b808-2badfa3b1b9b", "comment": "Malware payload (Dridex)", "value": "314ff6f23758ea4276929b4de4f7c573f1570e2075f6eb5d0647c2c9bebd842a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940512, "uuid": "2d04827f-a050-4f71-93bf-2d5e39831673", "comment": "Malware payload (Dridex)", "value": "1ba603a9ad598360d94840f3c32e1e9844ae33b4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940512, "uuid": "bd031271-2849-4a98-99aa-7078921f806c", "comment": "Malware payload (Dridex)", "value": "a714ee4406147e09e178a281761423f3496acb6d9c7d240b1cba23b14c96f2acfa6f0c1d4cfc93c3d46437d9fe4fdd3f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940512, "uuid": "d023b734-1c89-4ee4-be03-7bc5163b99bb", "value": "28F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940512, "uuid": "fbfe3fb5-b7c3-4989-8c24-f60e5951800b", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940512, "uuid": "d2f55181-1622-448a-a3ee-7e48d766577f", "value": "3072:6wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:6wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618940512, "uuid": "071ba4bc-56d0-4ae1-94bb-3c10d6012201", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618940512, "uuid": "fd3ede1a-8b9f-46e6-878f-22334fb3a796", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940512, "uuid": "a7fcb48f-155c-42d0-bef0-bb1305752cff", "value": "314ff6f23758ea4276929b4de4f7c573f1570e2075f6eb5d0647c2c9bebd842a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e36a89d-a1d0-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1618920079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920079, "uuid": "0ea33d7f-b8b3-48ab-8801-b989bb63fb86", "comment": "Malware payload (ArkeiStealer)", "value": "46ddcd557521e886e2548e72097e01d6", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920079, "uuid": "88ee9a93-379c-4bfb-80cb-2f5f51c25f3a", "comment": "Malware payload (ArkeiStealer)", "value": "3163e680a9b1c5c3b4e64b0fe808b79c5090a69bb3a359fbe18bbf9064dc4517", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920079, "uuid": "5e28fd6b-b4f9-4693-a35e-504bb1a20b1a", "comment": "Malware payload (ArkeiStealer)", "value": "fd4f34bc1ee6df6d2d04860b2b39349ee6221bf7", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920079, "uuid": "08adcd14-1674-46c7-b608-6052d807e579", "comment": "Malware payload (ArkeiStealer)", "value": "2bcb151790824a5d7ca1a33ed00089704e657440b96d398a41d8e2ac208d981161dab7e1db07d6388ed0aca7e82aa447", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920079, "uuid": "370e3979-4a7d-4e95-a71d-5f81db3bd9a7", "value": "D84412106E94D734EA80C871EE35C17088B49E0FE93264DBE84CFE4BB67558CF52A726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920079, "uuid": "3a5d1587-3bee-4411-90de-cbe430a374f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920079, "uuid": "d48431fa-52cc-4492-a0c9-516e17faa443", "value": "6144:ZeAIATt+8WSk4HgsljGmbtfUeAIQHuA36cdqQ:ZJIATtq94HgsN7eeAItC66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618920079, "uuid": "c0e72a74-583a-4367-9830-e0f64c5d0a3a", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618920079, "uuid": "aa854c29-8f2f-4cf7-92db-2bb007c05d8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920079, "uuid": "a3ce1e38-0878-46ba-8cd3-87cd1e40f22c", "value": "46ddcd557521e886e2548e72097e01d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f252fd-a1f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618934343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618934343, "uuid": "0467a311-80af-4b7c-8f6b-1cc9a4b57d9b", "comment": "Malware payload (Dridex)", "value": "5074d67967d78e893dd4a7ac2d06f7ed", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618934343, "uuid": "704af08f-7330-43ec-8395-fa4a3c05648f", "comment": "Malware payload (Dridex)", "value": "31766181c45841d770d9a41a7e958d679818444a849faef823fc7b04c281c94b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618934343, "uuid": "105ec609-2fc7-4ae1-909a-e651dfb4a49f", "comment": "Malware payload (Dridex)", "value": "51d4cd0d58ede41bf64a1095ed2d7b4d3841d2c0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618934343, "uuid": "4aed6875-3528-4a5a-b1a8-0dffea394e85", "comment": "Malware payload (Dridex)", "value": "b42288b2210259ceb33bdc742707a5a47a72a8d1ed8fb5b28ad0ff7695bcd56b42e344139f7504210be326bd8208598a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618934343, "uuid": "014185bd-3577-4586-a824-2f536c733fd5", "value": "F4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618934343, "uuid": "920a09a0-46dc-4eab-8482-0f09c7284d20", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618934343, "uuid": "fedab3f9-af3a-430b-a80c-2412984df17c", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618934343, "uuid": "fedfd48f-2893-4468-b0db-5244f8d3ce6d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618934343, "uuid": "f7487041-abdf-48c9-a7f0-cd1787b30d35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618934343, "uuid": "fafcae79-62c3-4ac2-8e24-63b7047ea5d8", "value": "31766181c45841d770d9a41a7e958d679818444a849faef823fc7b04c281c94b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcadf895-a19a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618897206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897206, "uuid": "a87c5e50-46fc-4af6-b6e9-0d0e998847c0", "comment": "Malware payload (AgentTesla)", "value": "41d13589b827da7db14e0eaf68d5df72", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897206, "uuid": "f56e16d1-68a5-46ec-8125-0a7b5e6ab8dd", "comment": "Malware payload (AgentTesla)", "value": "319ac7a3916438a335b5931150f6c12ce4d9f554a6cd21179ad1fc102115d3b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897206, "uuid": "bafe63ec-bbf1-4a83-b792-89a9532b617c", "comment": "Malware payload (AgentTesla)", "value": "f05c81514d8ca59ce6daf5e4955491d6ad96f65a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897206, "uuid": "d7beba6c-43b9-4a4b-a7f7-0478296ffb80", "comment": "Malware payload (AgentTesla)", "value": "8324bbfddff8c68d808d9a42914ff878aaf11251946e5d4c0dd414cdb1c296c6781501ee495934caa8c4b4806950c0d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897206, "uuid": "fcef247f-10cc-41bc-91af-3e5202c78e39", "value": "93D423AD0B7CE66D6FA9F77C4928B3153599B3338A6F0320102AB77070A676F594940F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897206, "uuid": "1e4387ac-8aee-4404-8a89-f12d5541355a", "value": "12288:2IC6lajZe9C+HBHzWlawG5KLPxIHoT5GhQhFvCzXuSQcADHyPnDoL4xXohPQFq13:2IC6lajZe9BHz405KNIHiOQTvCBQnDSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618897206, "uuid": "3e4b9642-d26e-42f9-99ce-8991d420136d", "value": 613618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618897206, "uuid": "0e816f47-dd45-4ef2-85a8-62fbc8f75993", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897206, "uuid": "a68f2055-21d2-4956-911b-cba1ca498237", "value": "PAYMENT COPY.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2bcf058-a217-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618950850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950850, "uuid": "ef9c7d6c-3658-4988-ae06-8006e35f5c0f", "comment": "Malware payload (Dridex)", "value": "e6d145d71f5d388c618964ad6ce8f6e0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950850, "uuid": "c37e99de-edee-491a-8a08-a2056ed36412", "comment": "Malware payload (Dridex)", "value": "319ede9eb08b34ab61bf6821b0c211e220d068cc6c314b248952ad5b7d598184", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950850, "uuid": "b23a8700-360d-46d3-9fe6-0ef2a45efec9", "comment": "Malware payload (Dridex)", "value": "682a55665d839ff0d5e94ab3dc6a718df30a4678", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950850, "uuid": "2fb47592-f1dc-49ab-8ad1-9f4782fe06dd", "comment": "Malware payload (Dridex)", "value": "d7b0a275816ecc48c9226b4e1bccfa78a31159841b713eeef00ca8a919461792cb844e53890fee7286a4681d2566aaf2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950850, "uuid": "2e8add21-0f33-4f63-bee2-8bfd0680e5ba", "value": "0EF3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950850, "uuid": "d9c6b053-2ab5-422d-bdd5-c826a30c1e59", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950850, "uuid": "fbc4c86d-29c8-4e07-97a4-90d3cd1083fa", "value": "3072:0wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:0wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618950850, "uuid": "428b6644-0fe8-4d66-b402-3481557b9da9", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618950850, "uuid": "a87e1f69-e617-4556-8e67-73c54fc8d758", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950850, "uuid": "87096f31-6cfd-46b6-8bd9-720a98d0312e", "value": "319ede9eb08b34ab61bf6821b0c211e220d068cc6c314b248952ad5b7d598184", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62aa8127-a22a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618958849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958849, "uuid": "fe95b8a6-d131-415a-a250-cfd849208f09", "comment": "Malware payload", "value": "6a4e5d75de467e5ff7b3617f3bd91fa8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958849, "uuid": "059cd6c9-aa0e-4b7a-ba13-a2a9bd16c509", "comment": "Malware payload", "value": "31c60683e3a43974c5b8461e641ca7a0ca124177434494d6f737133eb8e11790", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958849, "uuid": "c06e9a9d-e44a-4d6d-9c86-9c30c3eb5376", "comment": "Malware payload", "value": "947a18925b7fbbcf68cc2e9cea382732a2e8317c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958849, "uuid": "c42018bc-fcd3-4701-a1c8-00a4ec808359", "comment": "Malware payload", "value": "b22dbd527ab99fdd4bcc57507be6ebebd53413ed6c0330ab11a64dbfca1c28c9b8f0202f63582f593826f1c71a1b96d9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958849, "uuid": "a4c461e5-afeb-4690-b565-071989ab43a0", "value": "8DF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958849, "uuid": "e97c3d42-cd65-40ab-82b2-ce0c6aa32a82", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958849, "uuid": "63ea2be6-867b-402f-b3ec-571cfd6b44f6", "value": "3072:owZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:owZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618958849, "uuid": "aec40d1b-5ec3-4c06-8704-72eb79108d2d", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618958849, "uuid": "6714b748-083e-4170-85e6-ae991d322f1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958849, "uuid": "f52fe823-93df-4b43-b52c-d168a0b9e3bd", "value": "31c60683e3a43974c5b8461e641ca7a0ca124177434494d6f737133eb8e11790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1666ec-a21c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618953014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953014, "uuid": "1b21a30c-7731-4188-a88f-3274b51ecfd9", "comment": "Malware payload (Dridex)", "value": "7df2dfe6ac670a1e5157293bfa725885", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953014, "uuid": "e806a4aa-7324-48ac-aa90-097327bc0847", "comment": "Malware payload (Dridex)", "value": "31c9143dc4b55d8f2fe4c5adc7592e2bb5fbd2119d407229400d801f89de5af5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953014, "uuid": "d3ddfe81-ea85-4d4b-ad0b-7e0d8ab36b98", "comment": "Malware payload (Dridex)", "value": "428382c288e8d458b107f9b1e66cc4f8bab07528", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953014, "uuid": "b0f581ca-d783-465e-b501-03595923032c", "comment": "Malware payload (Dridex)", "value": "f7e65c40d5a2d07025188a62a0a345b80cdfc0b4346ec9d30c6edb80ddd466c02a2a38297ed628eb26de11da3364fd02", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953014, "uuid": "62200308-5d0a-4db3-a471-331752acc12b", "value": "8FF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953014, "uuid": "79132091-a02f-43fd-bc5d-fe494bea86ca", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953014, "uuid": "6e1f17e4-56cc-42ac-9473-da3b922a7c31", "value": "3072:7wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:7wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618953014, "uuid": "0cba0c95-e5f2-456c-858c-33f578549b21", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618953014, "uuid": "178b1138-8672-4565-b423-0f0c9e0f132a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953014, "uuid": "8a864d69-ce07-4628-8ab0-045d67d64e85", "value": "31c9143dc4b55d8f2fe4c5adc7592e2bb5fbd2119d407229400d801f89de5af5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f03d60-a204-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618942637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942637, "uuid": "4a2c2b15-9b07-4c9a-b887-e6ab922763f2", "comment": "Malware payload (Dridex)", "value": "abb91d2230d3867c089e7bf8350fc9ab", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942637, "uuid": "3c3a5235-ce19-42e2-becf-6aab61968468", "comment": "Malware payload (Dridex)", "value": "31c95d0a812aa43071c782e328472256225d3d98caf8c25ad91bd12a7343da6a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942637, "uuid": "5014bda4-4f56-4983-baa0-1a9757a7d27c", "comment": "Malware payload (Dridex)", "value": "1c7e01738d159be37461285f0a52223f17df4d4e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942637, "uuid": "f81e68bc-97ad-474f-91a6-1780b13537c1", "comment": "Malware payload (Dridex)", "value": "3cd579ee1b6dc936021b1fcaf90a4a826b2d4fc79d59ec626c45dc86ba2af5c9eba8694955ee9cc5abe52bf64f52c66b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942637, "uuid": "1e717fe9-8525-404f-b045-68be6ad4cd60", "value": "75F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942637, "uuid": "89e79dc3-f4a0-4d09-892b-588d974499a5", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942637, "uuid": "2ab80fe9-6e2c-45a3-a2a7-0c07993b1b67", "value": "3072:YwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:YwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618942637, "uuid": "699b77f0-2299-4e77-a1a2-5f5405332ef3", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618942637, "uuid": "91c975e6-586e-41e9-b93b-6d1d44b71298", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942637, "uuid": "085a2ce2-3cd1-43d1-8327-140e31f689dc", "value": "31c95d0a812aa43071c782e328472256225d3d98caf8c25ad91bd12a7343da6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a8b38e-a22e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618960805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960805, "uuid": "7d45f0bc-dc63-466a-ab75-8f7de60fec3b", "comment": "Malware payload", "value": "7302a00985f258efefff328d00ff8738", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960805, "uuid": "991c1eb8-e9e7-4260-aa56-8b74f6edfcc3", "comment": "Malware payload", "value": "31f8c2b45d4aa0ce61d8a95856826a8705569f8a6554c05dc7f5e58f97be9c21", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960805, "uuid": "fc2d8b99-fa1b-40a6-b1b9-3e5446ca932e", "comment": "Malware payload", "value": "ee9a6cafacec49796146567b5009cdf6a30ff782", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960805, "uuid": "c56e0c06-5274-4fde-965a-e899e8703ef6", "comment": "Malware payload", "value": "2a23b4e643c0f7787766f34261b93333ede365b2c6d7ad290be7bf527b63938f054be70afcca1dd5b7b901d0567f8bfc", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960805, "uuid": "40805885-d821-40a3-b06e-50c8f18c3812", "value": "F8F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960805, "uuid": "08ae0501-e735-48c3-aa23-4972ddddbee9", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960805, "uuid": "cb52c350-535a-4487-a8de-1dae2ddc675c", "value": "3072:/wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:/wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618960805, "uuid": "a0939288-bd8a-4244-9dc0-876ef0823bed", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618960805, "uuid": "1686fd3d-4c31-41d4-9582-22f04806a568", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960805, "uuid": "522a99d8-07da-41ac-9ca7-befadd71c62a", "value": "31f8c2b45d4aa0ce61d8a95856826a8705569f8a6554c05dc7f5e58f97be9c21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd92245-a230-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618961575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961575, "uuid": "9cf4e958-bfb8-4f3b-abca-147c6c62e295", "comment": "Malware payload", "value": "29b4838fc1b6f2d9597a190e6d1105e9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961575, "uuid": "4f2f2a0f-67f6-4a67-b355-0c23754791e4", "comment": "Malware payload", "value": "322c9a236d7f69ab9bf099bb5553bc32369ce7cfae97301282a40b80d71438b0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961575, "uuid": "2dca855a-b9d4-482e-bffc-aca02b8f2ac1", "comment": "Malware payload", "value": "05bf5b6d7beb0d5a2879da77564b1b8542131bdf", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961575, "uuid": "c2d642a5-087a-44a2-9718-aa7d3a851af1", "comment": "Malware payload", "value": "d2e5f6d1e636b83830fbd58d77922d676b7932cbae96b80c26611fcae6275af5c27b1db42cb16a5f25d2272687778c9d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961575, "uuid": "3a6b29ac-deba-44c8-bc0d-78bcbc8ce19a", "value": "F8F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961575, "uuid": "64b44303-95bc-4772-ae10-8e3d09942d05", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961575, "uuid": "55d89336-f378-4478-896c-78f7e7c67b1f", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618961575, "uuid": "2d98230a-daeb-4b0e-b1fe-729643e7bbc7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618961575, "uuid": "6cc99853-b1f4-459a-836c-1441bdae6920", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961575, "uuid": "c6ba45fd-bf28-47e2-938d-0637127ac748", "value": "322c9a236d7f69ab9bf099bb5553bc32369ce7cfae97301282a40b80d71438b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b4bdf8-a233-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618962671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962671, "uuid": "60d1c239-ddbc-4c21-af49-e82542e2873b", "comment": "Malware payload", "value": "b87c6f29c88eb1c61eccff8125fc81a7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962671, "uuid": "8e45d613-0c93-4d87-b3f7-d78c9a0278fa", "comment": "Malware payload", "value": "325d25bd463e2b2f3dcdbd81b7f9b281f0a867ef496fa17190cb8acdeea861ac", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962671, "uuid": "0fbb1c75-427d-4dd1-b7c3-1dd3174708ad", "comment": "Malware payload", "value": "03b8d18954db2502252a658580215a11376405b1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962671, "uuid": "e111f9e0-e407-4c30-9cab-d3d9cbacf399", "comment": "Malware payload", "value": "0545962639a8a2c8f6b970556b1706f33fda955052cd27b366e3e72b1e45a77a3240bfd1433051474ba4bfd83cb9400c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962671, "uuid": "890073c1-56eb-4d54-b914-172984c4a4d3", "value": "B1F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962671, "uuid": "50a79f7a-a97b-4948-9e3d-d8828120c954", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962671, "uuid": "930e3b2e-f122-4e26-a2fb-2d587f753886", "value": "3072:pwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:pwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618962671, "uuid": "0f0e8055-c836-45dd-a6ea-a653f7b71515", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618962671, "uuid": "b28687e0-7600-4e99-97d6-b56aa497f8af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962671, "uuid": "9fe85881-6241-430a-ba82-3920150d11f9", "value": "325d25bd463e2b2f3dcdbd81b7f9b281f0a867ef496fa17190cb8acdeea861ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff736ef-a1fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618939973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939973, "uuid": "9614e0ea-1c24-4665-b86b-e83ff6c11e8d", "comment": "Malware payload (Dridex)", "value": "b348d3b7609f225072e3b284f69ee1e0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939973, "uuid": "8217e2d3-d7c3-4a51-a527-58646996310f", "comment": "Malware payload (Dridex)", "value": "3283581c02fa06ddeeeda9f39077c6dfae402cfc16b8702d37ccb1a5a40cad46", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939973, "uuid": "658cd8f7-8b10-429d-8312-51f021133d12", "comment": "Malware payload (Dridex)", "value": "e9087a39a51a6d69b327f45c4c6cc436415a4fff", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939973, "uuid": "d03fb06d-9d0e-45c1-8e7d-f777f33fb727", "comment": "Malware payload (Dridex)", "value": "3aa322861cd11ae55ca0810a566e0e92aeff40e3899c5b2b4174740cafb64f80da5fc21fb950b36ea995d2d6ac2248d1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939973, "uuid": "56fa4b16-3ce1-46f1-b07c-0326036e4e51", "value": "2AF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939973, "uuid": "f0bd0feb-7eaf-4c09-a702-ac51dcd8c405", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939973, "uuid": "a83b8fa9-cced-4222-ae3c-1d00cc07c83d", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618939973, "uuid": "f986cbaf-9152-4898-96b7-09a9926b8f12", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618939973, "uuid": "3c9b5591-24a5-42fd-a344-f944c05d0222", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939973, "uuid": "c0569c3a-fe04-49bd-becc-76b010339dc1", "value": "3283581c02fa06ddeeeda9f39077c6dfae402cfc16b8702d37ccb1a5a40cad46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6526afe-a16b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618876982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618876982, "uuid": "72a27dd5-cef0-4963-b1d8-6f9d5d844e48", "comment": "Malware payload (Dridex)", "value": "8de6c04050d73b35a734264c469ef38b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618876982, "uuid": "a46cc766-5131-4c6a-96e3-5f22343f4eca", "comment": "Malware payload (Dridex)", "value": "32f92254b0553302753b7316165a3edbe942bd73c0249e52bd1c3b83b83af96f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618876982, "uuid": "11fac53a-48db-4528-8c7b-338455ec892b", "comment": "Malware payload (Dridex)", "value": "21f421c75022621d3a5e630885d8ac9fd681a3a3", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618876982, "uuid": "b1e91538-b991-47ad-a2ab-6da069204577", "comment": "Malware payload (Dridex)", "value": "7650b7eb4e42b7dab361f9a23648a880850c9d1cd63d91886e3b8634f22c505935e5d2f90a554d73d0c1dbe6ebe9f958", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618876982, "uuid": "0929554f-74b9-4181-bcca-fa0b9161d2d3", "value": "0DF3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618876982, "uuid": "3289ba82-fda3-41a4-b7c0-9c621ba0dc3f", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618876982, "uuid": "bbcf6819-e03b-4eae-b577-84aeccac8606", "value": "3072:mWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:m42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618876982, "uuid": "ab3a1e8d-a29c-48eb-b4c9-1a120c45644a", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618876982, "uuid": "dd61c6b0-231f-4ee3-9458-43f933495643", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618876982, "uuid": "5f11a683-0c94-4139-a751-6afb3d05c578", "value": "32f92254b0553302753b7316165a3edbe942bd73c0249e52bd1c3b83b83af96f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a60506-a1f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618934238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618934238, "uuid": "e6e33f21-4ae4-477d-9627-ab02f2af6117", "comment": "Malware payload (AgentTesla)", "value": "40266fe9750b0118e29f2c098482f8a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618934238, "uuid": "f99083fd-58a5-47cb-8c9d-adf9209545fd", "comment": "Malware payload (AgentTesla)", "value": "332e324313c3bbbae4fb70a55b8fa39998e972c476fedfbb41bf1ad83889f453", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618934238, "uuid": "f1cffe4a-5d72-483c-8325-34783ce31ce3", "comment": "Malware payload (AgentTesla)", "value": "5a6338745172573da2635de69d11319779830d6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618934238, "uuid": "e89f7136-33f1-4465-8784-2de7877b3a83", "comment": "Malware payload (AgentTesla)", "value": "29887fb749c31d23dddf7c94e66979f78715eb82fd066c98cf1598f0540837ac2783815c653e2e1175fa5fcd73e614ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618934238, "uuid": "9dfa4dc1-9ced-4f65-b7b1-4fe86ab38eda", "value": "44155B6C725475DEDA6BD2758AA85D64EB503C77434B420BE02330BEA93CC87DF160BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618934238, "uuid": "d8fc3045-07a9-4077-bd65-ee322e9a4738", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618934238, "uuid": "371d4686-a67c-40aa-bcd8-f8de5c67bd71", "value": "12288:1TeRsJVWdg1V3k9csCaQnAhW+tYE1sbbJ0kzRRRRR0Z7Hc80L4iuWa3pVFNKbr5l:hguxk9hWaYqENRRRRRGoJeLPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618934238, "uuid": "a8a1e35d-4368-420f-b621-45cd227c80ea", "value": 904192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618934238, "uuid": "7a4682bb-1871-4351-a4aa-4ecdcf61a268", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618934238, "uuid": "a6f8e2ff-756f-4bfe-8c50-73f3ac02968a", "value": "SecuriteInfo.com.Trojan.PackedNET.671.27490.2081", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1fa0847-a215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618950043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950043, "uuid": "5945d217-6d70-4708-a87d-33ecf44e6c7c", "comment": "Malware payload (Dridex)", "value": "f4051232f751d0bd015fb3e9e7dcc482", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950043, "uuid": "0066556a-51d9-40bf-a32a-6705d1f29948", "comment": "Malware payload (Dridex)", "value": "33517a4d269cc5e3d46b33cddaa15ac1aea5aa74620009bb10f97e2f573d713c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950043, "uuid": "63e094e5-7362-4173-adca-40875028e0bd", "comment": "Malware payload (Dridex)", "value": "964fa8b1631fc7d2ed740a6e312a7ac7e531da0f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950043, "uuid": "59a5644f-ccad-4b64-be8c-abcaba8a30d5", "comment": "Malware payload (Dridex)", "value": "70546c9c684c57c964f98405df90046040fca3228edad2ffc698a63fbd08f4b1668ee8105864b3577848bca5762a42fa", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950043, "uuid": "a94d7ceb-6fb8-48ed-945d-525040ec250c", "value": "5FF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950043, "uuid": "2aef701e-52c9-4594-b9e8-51c9ae107405", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950043, "uuid": "869338b7-cc53-43be-ae2d-3f4076628c3a", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618950043, "uuid": "1476c0bd-7c96-47fe-919d-89d7a615ce9d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618950043, "uuid": "5a6800e7-5903-432d-a492-f91828d3d121", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950043, "uuid": "1760b2a6-c760-475a-884d-a1286b926f9e", "value": "33517a4d269cc5e3d46b33cddaa15ac1aea5aa74620009bb10f97e2f573d713c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5da8720-a1d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618920844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920844, "uuid": "9fa2dd60-0ffa-4fe3-9089-101323fac9f4", "comment": "Malware payload (Dridex)", "value": "b07bf26659381b026aa4a97d57b9ae1e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920844, "uuid": "4270be0c-bef9-4c17-945c-36dc4efa7bd5", "comment": "Malware payload (Dridex)", "value": "33599858e7928e9b74688e8346261edbab6fe8ccb859a689267bafab5b59fbcc", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920844, "uuid": "2a4cec31-99ca-4d3b-9ee9-c75610693b78", "comment": "Malware payload (Dridex)", "value": "6d2c3894c3db201f0233d0689ed08c9d7a62a4fd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920844, "uuid": "ba5825f3-37e4-4778-a56c-6cf469f62177", "comment": "Malware payload (Dridex)", "value": "5c1b3d7c534de214368e4ae534632063c44fd826b08e62088a86216c98d726bc8f68e0006a096f1379116772417ba7db", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920844, "uuid": "2ba1e910-b1f3-4a17-9efa-60dbed7f2a60", "value": "2CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920844, "uuid": "699a8190-23e2-4372-ba58-4876245404ae", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920844, "uuid": "4230371b-6c3c-4ee0-a556-2ee38ba6c384", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618920844, "uuid": "d46560b2-5c96-49c0-9e7b-4f2441cf8616", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618920844, "uuid": "4762df49-fc12-4c9e-b7a4-5669cfae2192", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920844, "uuid": "54fa0da3-b2ff-48e3-8064-3a154733ac83", "value": "33599858e7928e9b74688e8346261edbab6fe8ccb859a689267bafab5b59fbcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca94827-a20e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618947054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947054, "uuid": "df71afd3-3c97-404a-ba1f-e2d14ec9c07e", "comment": "Malware payload (Dridex)", "value": "4829151d2d0b7d4a0a9d4efa85ddf3e0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947054, "uuid": "b02122d7-0a6e-4b84-bc82-e631b2ba32f2", "comment": "Malware payload (Dridex)", "value": "335e8df73a4dc2f0775bbe8143b75bf37d292eaf53bf4c05400e297f874f026e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947054, "uuid": "ee6cb436-7ca0-49f1-a12a-112c2b9458d2", "comment": "Malware payload (Dridex)", "value": "488a9ab2df0b37cf2662f67a296f20df751047fa", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947054, "uuid": "9235051f-3d6d-4246-9502-aaf223ff0715", "comment": "Malware payload (Dridex)", "value": "0889ee178cb7bc9a31e8d657b222fe11a55bb5426104608b21248f72049c7dce0c8b7a38fba8428b31e86cfcbfb2b107", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947054, "uuid": "2bb9342f-2dbb-47b0-a39f-1e8b42d6f987", "value": "EAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947054, "uuid": "4761a6a0-07a5-47a8-a8a4-537db32b33d6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947054, "uuid": "2fb4bf95-d150-4a9e-b98a-212eb9bea94b", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618947054, "uuid": "2eedb743-b89d-4295-8d18-af3e053fbec8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618947054, "uuid": "c328a5d1-7a9e-4b13-980b-f2f7fa69db5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947054, "uuid": "4f1b9ece-787c-4f03-a295-a88bd9fece93", "value": "335e8df73a4dc2f0775bbe8143b75bf37d292eaf53bf4c05400e297f874f026e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491af105-a213-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948927, "uuid": "72ce0ea1-3390-4b2c-8455-0831ef8fbb15", "comment": "Malware payload (Dridex)", "value": "cd6616f6cfa2c18e16288e5a26b427a6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948927, "uuid": "ea4ef308-0890-4979-8434-e74d8f91ed8d", "comment": "Malware payload (Dridex)", "value": "33ca131ce994e7464058690119004e0b15fc8e434fd3fc8d829c48d8467e781f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948927, "uuid": "27843d11-3539-4e7c-805a-bef23be61b7d", "comment": "Malware payload (Dridex)", "value": "cb0892317d9739e855efdb6a91677ce9f90782de", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948927, "uuid": "18b96562-c725-41ad-bfcf-7c243a250809", "comment": "Malware payload (Dridex)", "value": "7bb0f2c5933b1c6808f4686d56c35be628c23bf9d4dc10b5072b4cf5b5eebd11502f52d7572cc063cbb320f38cae5cd7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948927, "uuid": "8fc4aa99-dc7c-40a3-8b64-f649f012e134", "value": "73F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948927, "uuid": "69cf4ba5-49e3-41b2-9aae-06aeb8af0b9a", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948927, "uuid": "2dce9374-a545-413e-9f1b-14873e970f01", "value": "3072:dwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:dwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948927, "uuid": "5654bcde-f126-47fe-bedb-dae730b2bda5", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948927, "uuid": "b9ec05c9-85a7-4645-aa33-5f8952c36bc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948927, "uuid": "2a7c21f7-67e0-4330-ac98-a1dcd379e275", "value": "33ca131ce994e7464058690119004e0b15fc8e434fd3fc8d829c48d8467e781f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eff8da9-a216-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618950280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950280, "uuid": "8362e7c7-5547-4217-bc07-e9f5d985d291", "comment": "Malware payload (Dridex)", "value": "cbb2e4f4f5352d9b7ab629f87f2955cd", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950280, "uuid": "3e614c48-3d49-4c84-b0e7-4d03b425a7de", "comment": "Malware payload (Dridex)", "value": "3427b16e28c6c57850c637fe719c0105583ecb185c9ddd30eefab6d975062ee2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950280, "uuid": "700fe3e9-44c4-482d-aff3-ae2b8f5eed58", "comment": "Malware payload (Dridex)", "value": "4d2cef79e94adec57372279fdbb8d3488dd59f1e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950280, "uuid": "d2287fa7-eae1-40ce-8f6c-473be283d271", "comment": "Malware payload (Dridex)", "value": "7dfeb2c53d6c82598d45512743a4a1eef7ab651615f4bbf18e6a4ef38dde64f0d1fad83de83dfb89c1dcf116e722e3c3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950280, "uuid": "5c7a12f8-0b36-45d7-93ae-80028517e644", "value": "3EF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950280, "uuid": "67826622-262b-4571-9c33-f1b4554c9e04", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950280, "uuid": "b5641b88-f84c-4f41-8387-ef02d02c7987", "value": "3072:4wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:4wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618950280, "uuid": "d2d8cbfa-54a5-47be-aaad-af1e510631a1", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618950280, "uuid": "fc358b18-8155-401e-8b2b-aec211212298", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950280, "uuid": "c1527d7c-73b1-4534-aba6-1140202e1a1d", "value": "3427b16e28c6c57850c637fe719c0105583ecb185c9ddd30eefab6d975062ee2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1accd78-a178-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618882611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618882611, "uuid": "8c073bd0-9205-44ff-9104-b50aa4c018c3", "comment": "Malware payload (Dridex)", "value": "d8a5e36adcaec97c96de51eecdc55405", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618882611, "uuid": "d0984b02-d19e-47d7-98e2-caaddb8fd476", "comment": "Malware payload (Dridex)", "value": "343b59be888843ae7052675cc3bfc446b56c311fc7293ced9319b6aaf2d50062", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618882611, "uuid": "89637ad0-c6b6-4351-b152-ea04e97bd7c4", "comment": "Malware payload (Dridex)", "value": "e67f46cce98200e00fca645845288b4f68db5ccc", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618882611, "uuid": "03241974-5111-422e-b1f0-7c5e83609cd8", "comment": "Malware payload (Dridex)", "value": "791b2ebe2e9261104125e17044cfde8b53be178fd5b710065be962cb123d361af3dcb1d568f15c1dfedf18ec08672d91", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618882611, "uuid": "50859af3-59e6-43d4-ae01-91be4a1da2e5", "value": "D4F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618882611, "uuid": "37b3ccc0-6f32-43bf-b48f-4d728a7be034", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618882611, "uuid": "8d62dad0-b914-4f20-9308-2cec51246956", "value": "3072:wWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:w42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618882611, "uuid": "47d5947b-d52b-41d9-b17f-84075e07c3b0", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618882611, "uuid": "2d0e575f-bc93-47a7-b877-6fabb6a33216", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618882611, "uuid": "76b40b61-bdd1-4dee-aef2-a127702184af", "value": "343b59be888843ae7052675cc3bfc446b56c311fc7293ced9319b6aaf2d50062", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae395e2-a21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618953762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953762, "uuid": "7134ce9a-6b2f-4140-9ae9-db445a861638", "comment": "Malware payload (Dridex)", "value": "95361fca403f0c3d89f0d7d70eafebd8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953762, "uuid": "9c745bad-f1e2-4b1e-bbbd-b06ca0c76fc2", "comment": "Malware payload (Dridex)", "value": "345f99736a754fdc77de4fb7bf8a1243c257e531e0d64cb81e56052bee72197b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953762, "uuid": "af5b701e-810e-44d4-99df-62f84070291f", "comment": "Malware payload (Dridex)", "value": "dfe34ef881b6e5ca18d1cbb658f572efaa79ffc8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953762, "uuid": "4dbdbb82-2a95-4a7d-b127-2cddd2a3932a", "comment": "Malware payload (Dridex)", "value": "7f459f27abcaf4ae9ae41684cddb3b1f3fcd51fbb74ee2f2b042a770edbf064a17d55876ea7fd5cb338f5f7a41d0e651", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953762, "uuid": "1e3f2f98-568d-42b3-a179-f3b9d8e35a34", "value": "60F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953762, "uuid": "5b115ce7-6df8-4c08-a61a-715da420098c", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953762, "uuid": "df59c617-9de6-488d-835e-c99b7c71253b", "value": "3072:twZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:twZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618953762, "uuid": "c28f27c2-dd6d-4f9d-8e72-c68aeb255f2a", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618953762, "uuid": "72bf974f-a43e-4ded-ae82-a0ba5fb8abfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953762, "uuid": "6c6254ee-fe67-448a-9e10-970f725bf09d", "value": "345f99736a754fdc77de4fb7bf8a1243c257e531e0d64cb81e56052bee72197b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8422cd-a233-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618962924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962924, "uuid": "6e12b95e-fa1b-454b-9103-ef6d7e7ac955", "comment": "Malware payload", "value": "8a15076340f15c9a153e0d0f0f4d6f99", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962924, "uuid": "24da5a33-5faf-41d7-8f50-419410613b87", "comment": "Malware payload", "value": "34a179c47f6e88f5ad2813e0bab53a998c9833e5b816199fa4a42a55086574fe", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962924, "uuid": "c56033e0-00aa-46fd-8268-c0945270cce5", "comment": "Malware payload", "value": "a9ba424e996675903637e1b7ec4031cac892b123", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962924, "uuid": "36896a12-699f-4bba-9ff6-e171ef2529fb", "comment": "Malware payload", "value": "9482be702f475b24b1dd7181c77bbb35bd97c64744e99d03ea18b054c2fd13a771f04d9a073e052a8d4dede2fe630d14", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962924, "uuid": "18304404-148b-40cf-a41b-c67aaddb2a1e", "value": "08F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962924, "uuid": "f4db66b8-b276-44b7-84ad-2da970dbb706", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962924, "uuid": "ea71452c-4b07-4b8a-8560-1c83ab3884cf", "value": "3072:RwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:RwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618962924, "uuid": "26d7f883-da9f-42b1-a085-8b1a45b770a9", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618962924, "uuid": "b41aaad1-c813-4841-901f-47f36d8c01df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962924, "uuid": "94576855-b54a-48f5-991b-392fb02ee28f", "value": "34a179c47f6e88f5ad2813e0bab53a998c9833e5b816199fa4a42a55086574fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be9786b-a218-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618951106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951106, "uuid": "0359736e-e8e1-457d-9e7e-b2ffc20940b9", "comment": "Malware payload (Dridex)", "value": "fa56a5a1a3ffbcc0d70bfe910ec14074", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951106, "uuid": "1373cf35-edfa-487e-950e-89e69739490d", "comment": "Malware payload (Dridex)", "value": "34b47ed2d60fef632578a05b39cf48f86bc749102c2865ca4da9085dcaa6815d", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951106, "uuid": "535f02d5-b8d7-44bb-9b94-5a9b63f75eb4", "comment": "Malware payload (Dridex)", "value": "248cc565155808521e20c4abd05a3d081a663948", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951106, "uuid": "30d6782b-5fdb-45cc-b3ef-18a8f05f7bad", "comment": "Malware payload (Dridex)", "value": "36c72f3cb6700be6100d94d8cc1181d30de163cd20d16f9444ee179069efd78cfe6389772fb14a5988e94906e08f81cc", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951106, "uuid": "a9428e37-bc1f-424f-bcfb-5b3b6b0b6f60", "value": "58F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951106, "uuid": "34024307-cadf-472d-bef9-f435c0c10822", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951106, "uuid": "484dfb50-6fdb-48df-afca-d92d829f29e5", "value": "3072:GWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:G42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618951106, "uuid": "0485a432-8a86-45c4-9163-f7699e4ea5c5", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618951106, "uuid": "1ff0c756-9e38-471d-8310-f3a21f308a80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951106, "uuid": "b439e727-2280-410d-b020-51edda2cf4a5", "value": "34b47ed2d60fef632578a05b39cf48f86bc749102c2865ca4da9085dcaa6815d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d339e0-a1d5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618922288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618922288, "uuid": "55bfa36d-a20f-47b9-b8d5-b8bc3ac3d0d7", "comment": "Malware payload (Loki)", "value": "01b22be6717e0fa7857fd6dfd8f91c18", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618922288, "uuid": "fc6f1fa6-9c84-4d09-aaca-3c68ad1da216", "comment": "Malware payload (Loki)", "value": "34b4cc54cd8d3294a210381b7f27a9d0284214ecb26c9ad4c685a3d568d295f6", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618922288, "uuid": "f4dee698-26f1-405f-b386-25cbff84ec27", "comment": "Malware payload (Loki)", "value": "3691849757b57284826856fe2cb95e3dc5f68220", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618922288, "uuid": "43076ae4-ec71-4a87-86cd-398e3096a87c", "comment": "Malware payload (Loki)", "value": "34f76d2ad2fc435b8b94c4a743ec2f0715d76879c0738b041c930de550944c037dbccfced3b3debbea3b34aeb0d39994", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618922288, "uuid": "baa56d24-ba13-4f11-9499-8226e2781859", "value": "15C5335EF10B46A1C5E198B92B4151DD3DBA634FEC21E68213B8FF61669D1EE0C207EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618922288, "uuid": "264e7bc5-4bc3-4c7c-b691-3baf0656dac0", "value": "49152:YXuewyOGGGnG0GGG7jpP7OGGGTU5dUGutLl9d2Av4gpuodY3GeMqBMnZuDybrWGf:GuewyOGGGnG0GGG7jpP7OGGGTU5dUGuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618922288, "uuid": "12e615ac-35ce-484c-8e00-c5885b7f2ff4", "value": 2577763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618922288, "uuid": "abd3d1bd-331a-411c-bab8-a8736e64d33c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618922288, "uuid": "da2045f5-26f7-4b0b-bed8-0597b7543215", "value": "REMITTANCE_ADVICE_REF0000360261.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a98ad1d-a208-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618944232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944232, "uuid": "65ac0302-53ff-48bb-b284-2fde20dc1e82", "comment": "Malware payload (Dridex)", "value": "cecdd2546a27bf55c2e49b9ad94247db", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944232, "uuid": "ea9812f3-0d60-47b1-b332-9f2973e23b70", "comment": "Malware payload (Dridex)", "value": "34e2ee759ba466ff5f874d9d44f79d3e5b95c5799f4e1297c2173a7b5e46e9fd", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944232, "uuid": "f1285440-5984-45f8-8f66-8f9261e084a4", "comment": "Malware payload (Dridex)", "value": "af1dc12bc0d411f3d9dddbdf12ace422c03a9f2e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944232, "uuid": "6761c6d0-9f6d-4216-b327-37aa835121bc", "comment": "Malware payload (Dridex)", "value": "c1398838b538a44915656fa8455d5f53d34fab20a81156e4fe3b3482d0715faf5830ab9ddbe0da580b47c78623473ddc", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944232, "uuid": "c1186454-6ed4-4fb9-8b5f-55e2f481e35d", "value": "F4F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944232, "uuid": "c1841d5a-4d57-4b59-bca7-8e01be81d353", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944232, "uuid": "2383f683-4631-4040-ace8-083fd1844d48", "value": "3072:fwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:fwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618944232, "uuid": "c9f3217c-a4da-4365-9ab1-a863360f81a3", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618944232, "uuid": "5dfd2944-8b58-47e5-8f96-f852918159c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944232, "uuid": "b86b44dd-0546-4fd2-82d2-2155368904a6", "value": "34e2ee759ba466ff5f874d9d44f79d3e5b95c5799f4e1297c2173a7b5e46e9fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41fad334-a213-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618948915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948915, "uuid": "5b8f8f9f-5421-4fc2-b5b9-f7cce380b763", "comment": "Malware payload (AgentTesla)", "value": "1ee0b2db979e9bfe4a06aafbdaee9059", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948915, "uuid": "ef253996-ce8e-448a-bf70-40bd73e5b7cc", "comment": "Malware payload (AgentTesla)", "value": "34e7c4fe685008646d1eeaaf4cec82abe5a4b37326529bf29944212f07e69f8f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948915, "uuid": "e859227c-20ea-44dd-a948-1a92dbb69536", "comment": "Malware payload (AgentTesla)", "value": "02bcc7c01b1ebc210b1147cc1a79ee79d706177e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948915, "uuid": "82e03c27-3e14-4fe5-b6b2-ad6c8a98570f", "comment": "Malware payload (AgentTesla)", "value": "dc57be74d9439035d4bf02f8f631dccbef005f8bb7dbca0344c3a6d8c48362dc2df7c9dadda53db4eb071bf7c56ef550", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948915, "uuid": "d81eb746-3200-4cdb-bcf5-00abd1310687", "value": "D8156C6C721475DEDA9BD2758B589C64EB503C76430B820BE02735BAA93CC87DF160FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948915, "uuid": "376033aa-10fe-4726-946c-def1d4d2962c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948915, "uuid": "c3f22662-13a6-404f-b7ba-0cd4c741e7b5", "value": "24576:c2AxdzUW5lNzXU8/kRKRRRRRudT68eHvZ:YzUaVMRKRRRRRudFeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948915, "uuid": "218f5a45-1704-46bc-9b31-495146455ea8", "value": 928768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948915, "uuid": "42df9cbf-5add-40c0-988b-d03f6bbee1bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948915, "uuid": "bab24539-55b5-4a16-b266-190996066bc9", "value": "Revisar factura de pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e892aa2-a226-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618957043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957043, "uuid": "619690df-6dee-4d50-99a1-7309739709c7", "comment": "Malware payload (Dridex)", "value": "5e000690a1d4e7ea0a5a848164153417", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957043, "uuid": "096c7c0e-bf02-4c34-b3aa-a38e1f9bc911", "comment": "Malware payload (Dridex)", "value": "34f8a3af59af6c5619764677473906ab0deeed2e9e0d9b0872c1add6959b4519", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957043, "uuid": "f540fcc6-063c-4b24-9566-2064ef1b9671", "comment": "Malware payload (Dridex)", "value": "76d06d92092dbb536f84fd2112d0f06cda6fa3dd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957043, "uuid": "ecbf4759-6939-47e0-9201-617573861477", "comment": "Malware payload (Dridex)", "value": "a81430460a32162427c162f758de2b9aca2a1f9712fedb75e5672f52aaf23977a8754c7b483f25365a20ca3071b5072f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957043, "uuid": "0b3c7a16-3254-4766-a507-1aeeb4c44449", "value": "3BF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957043, "uuid": "30f95bc3-df21-4e4b-b353-3e81f0808ad5", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957043, "uuid": "32bc06a6-06cd-45b9-ba49-ed2810ef8191", "value": "3072:BwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:BwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618957043, "uuid": "58c3524c-c84c-473c-a851-96c2c1a533ae", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618957043, "uuid": "319f936e-2200-4122-8879-37ecda21ff53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957043, "uuid": "e6b48f13-3deb-4ec2-ae98-0a6f0d2f3d75", "value": "34f8a3af59af6c5619764677473906ab0deeed2e9e0d9b0872c1add6959b4519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942f66fd-a21c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618952919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952919, "uuid": "ae8b2452-2541-4c57-9c99-7ee27c1d07ca", "comment": "Malware payload (Dridex)", "value": "a14c596b72b1c01a8a3ea23ad0cf616a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952919, "uuid": "f70dc2f1-e0cc-47c7-bb8f-8b8c1da5cb40", "comment": "Malware payload (Dridex)", "value": "3526da725c432232b276ecfeb777149d9c7235773a48c00c527fb21c36f1346d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952919, "uuid": "c73ff5ee-849e-4840-b062-0d206a5c7eaf", "comment": "Malware payload (Dridex)", "value": "438b4c6dbfbc69c7df7d885023d9e79a2ff56b1e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952919, "uuid": "f56cfc1c-5c7c-496c-a0e8-cef88defceb8", "comment": "Malware payload (Dridex)", "value": "a6af9008b2626b78c0346051cfba5619fb0a26b1835c146c37806aa31a9c9ce475a1b1455aa5be340742d9aaf43d75fc", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952919, "uuid": "90e606e6-ceb9-4950-b848-01685a0c6688", "value": "8FF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952919, "uuid": "8697c92c-0411-4171-b913-97fc3202e798", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952919, "uuid": "3dc799f2-4200-44b7-a8bd-6463098a5fb7", "value": "3072:iwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:iwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618952919, "uuid": "73d8531c-64c3-4970-b244-277fba86c502", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618952919, "uuid": "baee12b5-2eaf-48b6-9e71-86f9bad50016", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952919, "uuid": "b6fedb05-e846-4594-8dc8-d7a8c0cb718e", "value": "3526da725c432232b276ecfeb777149d9c7235773a48c00c527fb21c36f1346d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71fc5da5-a193-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618894020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618894020, "uuid": "d6e6f4b3-b10c-4423-b83e-ba157d9182cd", "comment": "Malware payload (Dridex)", "value": "656388f1e1b4daa11be18a298d0171e7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618894020, "uuid": "5274c1b4-c24e-43e8-859d-3bf5d404a50f", "comment": "Malware payload (Dridex)", "value": "356620ea109c0e39ea6c680ddd8fdb88796487bb23cedd3b2cbafa8e83bafd1c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618894020, "uuid": "cb596d15-1c42-41cc-b3de-57b8f9b5f6eb", "comment": "Malware payload (Dridex)", "value": "b95657667a6e70f98182c5050ef68c58400cabc9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618894020, "uuid": "882dd52d-fa12-4cc0-8d05-d183b1e5708d", "comment": "Malware payload (Dridex)", "value": "c4686dd395eaa12a3ad7fce89543de1d1a36ecb56b3f96933b919f23fd4156a73b8abc28720d9a788732317be11830cb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618894020, "uuid": "9554081a-2003-458c-b909-254e98f9161e", "value": "E9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618894020, "uuid": "36b79b77-9304-4188-b1d6-913480b187e9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618894020, "uuid": "cd2f1aa8-60bd-459b-b03e-3c70ab61fd91", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618894020, "uuid": "326d81da-9df6-44ad-9d76-69acc67c13f6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618894020, "uuid": "5c60f0c2-3425-49fb-bc05-5fefe9456318", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618894020, "uuid": "862f1b7c-3bab-42dd-9aa0-63c7828b60ff", "value": "356620ea109c0e39ea6c680ddd8fdb88796487bb23cedd3b2cbafa8e83bafd1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f2661f-a218-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618951154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951154, "uuid": "661d4ea1-0ebb-4494-aa32-36993209db08", "comment": "Malware payload (Dridex)", "value": "54138beb6bcd8f12c8ac53eb9e59b208", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951154, "uuid": "45d53c57-0ddb-43bb-890f-ec98c349e426", "comment": "Malware payload (Dridex)", "value": "3590bdf8ff5662f9a9b930ca93a998cf981bb9ec0256f81709ad932128b3e37d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951154, "uuid": "67f4d106-c383-4d3b-952b-e8cee9277500", "comment": "Malware payload (Dridex)", "value": "70c4297ea649980cc4395b359320be14e440c8a4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951154, "uuid": "0fc548ac-3ece-4b75-a8b4-d08d0d69bbe8", "comment": "Malware payload (Dridex)", "value": "81dba077482f732e26b0c86e7647ca5d642bdbc29e9e8816cf2389e74fdd02cb0e7e1844ff2ee0b6fd49af94fbc933b9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951154, "uuid": "fda9b288-3a70-41a7-9c89-b068bca1e4ea", "value": "52F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951154, "uuid": "b4846e82-2b87-4fa2-b55e-22ebe89b9a01", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951154, "uuid": "f622b323-93f9-4549-844a-1f4ac603d2e8", "value": "3072:ZwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:ZwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618951154, "uuid": "effe81fd-e114-4fa8-a9a7-ee8f3e5b0fa8", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618951154, "uuid": "f4e806e8-1abd-447c-931c-bfd48ffe1571", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951154, "uuid": "9e5befd5-fda2-4aa6-aabb-711e6616c83e", "value": "3590bdf8ff5662f9a9b930ca93a998cf981bb9ec0256f81709ad932128b3e37d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ec449f-a19e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618898673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898673, "uuid": "00b5cd06-c4de-4948-98d2-eb5c1a3403c5", "comment": "Malware payload (Dridex)", "value": "0520cce8c7ab82a5fb169299de7a9187", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898673, "uuid": "aacd0579-4961-42b7-9449-bf41c472b924", "comment": "Malware payload (Dridex)", "value": "35f914846a1483796766d38ae25d006b425c0074d680314c9890ca11b20bd7d8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898673, "uuid": "fd4205ac-489d-45de-8b86-8b5659c2e053", "comment": "Malware payload (Dridex)", "value": "704e30ce819f1b27a531e4a3c7ba0c23c5a42166", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898673, "uuid": "eb94d32a-71b0-4e8b-a94f-2f313361cdef", "comment": "Malware payload (Dridex)", "value": "8004f9704d93583cb143c2dd0e86007bfa7c3000706c5c461fcb30fe4121a53a8034d1c35dd2d2982f7ffc150fcdafbb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898673, "uuid": "f6f994cc-4906-4572-a98c-ec42e65ee5c1", "value": "7DF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898673, "uuid": "6f6a26fe-28b7-4c27-b06c-06c5d7ea71d0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898673, "uuid": "99b5dc1a-494e-4959-a8f2-9675fe223ee8", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618898673, "uuid": "62ccc506-13c8-4216-9c6c-4403d5de795c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618898673, "uuid": "cabf0fdf-1515-4b33-b53d-0a0e4db3a764", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898673, "uuid": "bfb38f32-d8df-493e-b42c-77ea8b7db782", "value": "35f914846a1483796766d38ae25d006b425c0074d680314c9890ca11b20bd7d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdfa64bb-a226-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618957311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957311, "uuid": "95054521-4644-4458-a754-959f000911ab", "comment": "Malware payload (Dridex)", "value": "a5cea0f8a228205190e6829b2ad90e0d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957311, "uuid": "03b1b9b3-b9c6-4057-8f92-8832308f52a3", "comment": "Malware payload (Dridex)", "value": "360c2150f4673945114cfd46ab7e495fc5467eab11d316d7a623d03e3cbf3f96", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957311, "uuid": "b14299ce-2c42-4eca-aa40-b2e469c76a74", "comment": "Malware payload (Dridex)", "value": "f7e285f59d0eac7c9cf109895a293d2993f2686b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957311, "uuid": "d0c4aa3a-fd1c-49b2-9a45-a51b39965a18", "comment": "Malware payload (Dridex)", "value": "acd794644c433de8f9c2dcf0e79aee3989b104db8e9125bddccf39433081507c2c31b66d1f5f0f5ae86e31b3f1cb2cb5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957311, "uuid": "29193488-3c3e-434f-a776-8b2779e67563", "value": "51F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957311, "uuid": "43e5acb2-c342-4eec-8042-dcbbae824cdd", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957311, "uuid": "094fbbcb-ee30-45e6-af4f-2c1b0b136705", "value": "3072:gwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:gwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618957311, "uuid": "f1778929-bc45-43e3-b9f1-71e8674687ed", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618957311, "uuid": "cdbc71e6-c66d-4a01-b57b-39b0607e619a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957311, "uuid": "ace084be-679c-4163-858b-6c9dd10c95b2", "value": "360c2150f4673945114cfd46ab7e495fc5467eab11d316d7a623d03e3cbf3f96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4862074-a185-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618888200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618888200, "uuid": "bb0d06c8-4c6d-41bd-9780-d5e048b29759", "comment": "Malware payload (Dridex)", "value": "afa65b65041efa5840e514db1a175a0a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618888200, "uuid": "1050b2c0-de7d-40ea-92dc-887c26e60c73", "comment": "Malware payload (Dridex)", "value": "3612cb4691a787f5159d4b04c87ef0c09a75a33bf3fb529086123e5b286eabca", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618888200, "uuid": "655b7754-cd26-43df-9125-9718d1a24e2d", "comment": "Malware payload (Dridex)", "value": "a461bfa70808a2b2405e92d22e44cf59aefdc926", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618888200, "uuid": "d7186189-0c63-45ad-9c27-aca4f493d20e", "comment": "Malware payload (Dridex)", "value": "8080a18e6a9413c5433635402b14099cbcd0ffbadb71af167fca25361b9519ef79809dfa3a838f1f46ffbaa39ddea337", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618888200, "uuid": "3a03a354-62a2-4584-9230-d27c4820053f", "value": "BEF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618888200, "uuid": "b1722b43-a7b1-482c-84d2-6349c8b0109e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618888200, "uuid": "45aebdea-fac1-49a9-93e0-6b8750ea8e9c", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618888200, "uuid": "816caed2-77d6-4998-a79e-67bf3d227c7a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618888200, "uuid": "5e5d4480-7115-4407-8db6-5c3464eda59a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618888200, "uuid": "7dee7412-a729-481e-8b75-33af15c0050e", "value": "3612cb4691a787f5159d4b04c87ef0c09a75a33bf3fb529086123e5b286eabca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a0a511-a201-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618941159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941159, "uuid": "65a436ce-7f68-47a9-be5c-695216b9afda", "comment": "Malware payload", "value": "0b278b51a383b4d668068163cbef04b4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941159, "uuid": "641bd4c7-24f8-4d2f-b40a-5ddfb6f2ded6", "comment": "Malware payload", "value": "361879d9eb1fdfea84499253a1213ce4cd2e4a76cb0bbd2275c10027bd7ad5a3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941159, "uuid": "f739e084-8bde-42e4-ba23-3434ad952969", "comment": "Malware payload", "value": "132e659d5083117c9393de6a7501fc62f9d261c8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941159, "uuid": "c1031e41-e3e0-413d-997a-c055a31773b9", "comment": "Malware payload", "value": "2a9826ba1522b614b60944ce0e6e3718ec0d751efc2b51657da1080ba4190bd04b779491ddaa470a925b5fa66a041225", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941159, "uuid": "4cbd2eb9-ca52-404f-aa9f-3fd4d358e048", "value": "B773E70477E5CA22E169AE314FE3D6DA7331BC41AD55870B32C9332F1E3A9509E93B09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941159, "uuid": "58c0aee6-8a4a-46df-b1bd-251b6f642fda", "value": "192:0VQmEVWkiElXDRDT//zqHRAcp6r/yyTLUBjFlHM6bzS9dUY/R0ldTe:hAIXDRP//zqHRAcp6rk5HM6bzUUgRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618941159, "uuid": "5481c2d8-2c92-48db-81e8-bd3a5ed7ed9d", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618941159, "uuid": "de084479-e023-4035-a257-74584f3a4e92", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941159, "uuid": "5b835524-3cab-46f3-990f-03509c9fe58c", "value": "SecuriteInfo.com.VBA.Logan.1396.20651.11005", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac4249f-a205-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618942944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942944, "uuid": "a2261f5d-a619-4f34-84b7-47fd5ee2ee80", "comment": "Malware payload", "value": "eab6b1bd47fddc4ffbe965e7fd850baa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942944, "uuid": "7de0faed-dd73-4e0e-8fbe-ae2a76e7dbc2", "comment": "Malware payload", "value": "3630453a0eba6ba7ed08118e35c2da4e27cbd71869b68d4b0279f36b9ca28905", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942944, "uuid": "8dbd5322-d447-4d9a-ad14-64362b7947db", "comment": "Malware payload", "value": "88d9d7551506d3bc4bc600aa66f04a6f5a88717c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942944, "uuid": "d7a6b2ad-7fcf-495a-984d-baee53743f48", "comment": "Malware payload", "value": "2a3076c3657a528d891cbe174ed93b3c0232e74c3b8da0a47768328e92e455f61c81b1f8b5c221c364d3ea217f183ddb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942944, "uuid": "44b2123f-be2d-4233-b5dd-2b3c0aa36167", "value": "05A3AE38B365F98BD08E673CFCF1B239638986E5E25332C27C8C99641B4415226DAD7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942944, "uuid": "6467ad88-d3fb-4ead-a12f-6fd2258f5c30", "value": "1536:obvz6f0rLVJwhdklvI0APY2ywnbcbWSfZL2+wSJx8+RBZe0nV3AgXf0lSQw6eDOZ:czs0FvlZAPY2yWwb3ZadaxHeuNQpeDdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618942944, "uuid": "296e2fd2-69e4-48ef-8e11-04ae04aae27a", "value": 106344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618942944, "uuid": "171f39b4-bee0-491d-8694-3be986cb69f9", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942944, "uuid": "7a34455d-59c3-4de3-aa64-402051ac024f", "value": "verschreiben 04.20.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38c7581-a22b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618959494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959494, "uuid": "5d3da13d-de02-405a-b1dc-c6ca4f3057b8", "comment": "Malware payload", "value": "3101bd26a7033abe4e67c71a515cf988", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959494, "uuid": "9174e7cf-93cd-4b7b-a178-831a75a9172e", "comment": "Malware payload", "value": "36510e2372d6aa4b2e3952bec9f97f37d0d58c5cf279de0c4b8a2fd061be8b73", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959494, "uuid": "6926d55f-aae7-49d7-b8c8-500e65c1ab32", "comment": "Malware payload", "value": "3b1685c692b8b8d8229d962239c7b71513715fd5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959494, "uuid": "bd28c915-350f-432d-bc7e-c21bee07f9a7", "comment": "Malware payload", "value": "2361bf514dfc34f4e4d2c7bd16fec68cbf56ed2c7330b5070ceb1ab849fcf853dd89025a2632513f9834743e7df25efe", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959494, "uuid": "a284ef1d-bb75-418f-bfa3-7d39191d2bab", "value": "8CF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959494, "uuid": "0ddac7a3-ba6b-4cc6-ace8-71d90892f13c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959494, "uuid": "9101a2cb-07bf-4835-996d-760af4ced3e3", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618959494, "uuid": "846cd53a-a4a2-4686-8275-440d92ac1fd0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618959494, "uuid": "f5089335-5316-4608-a192-2882e61f0c9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959494, "uuid": "101c7a2b-b4c8-4579-ac8f-aedab0cecb8b", "value": "36510e2372d6aa4b2e3952bec9f97f37d0d58c5cf279de0c4b8a2fd061be8b73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ebe7ee8-a22c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618959782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959782, "uuid": "b732ba7a-6edc-4033-8af9-a6fbbc507278", "comment": "Malware payload", "value": "69dcb7deccd7a25e169797b8a9f72d80", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959782, "uuid": "40ccf40b-c5c8-421c-948c-71a528cb76ab", "comment": "Malware payload", "value": "36bc5e407bd9e99326dc749d1359827744bf3713dd1d215ecf01bd3385db21ae", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959782, "uuid": "6c22047f-d284-4043-ad18-d4e3485775c2", "comment": "Malware payload", "value": "39b5861e9c82dcca66d967d59b179c31c77117da", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959782, "uuid": "7df2504d-40f4-4981-8411-704f7f236d56", "comment": "Malware payload", "value": "b5bd43b9c2b3ccef3782587a7ae0ef053520d416558265377355ee5e4efef29111aeaa1cf51982fd05c0aeb74fec966a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959782, "uuid": "32af5b69-1fc9-415f-adfc-dd5e0f344290", "value": "E8F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959782, "uuid": "ab689361-590d-46a0-82a0-e8d506b46279", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959782, "uuid": "cdebba6e-ec31-41af-bbf2-4e34df718f34", "value": "3072:QwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:QwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618959782, "uuid": "5ac75d73-3160-4d7f-bf49-1b6d7c76702d", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618959782, "uuid": "3da8b098-60e4-4938-b17f-d8beee27f414", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959782, "uuid": "8f9899e7-3193-4a15-8b04-1e064c3cb9b1", "value": "36bc5e407bd9e99326dc749d1359827744bf3713dd1d215ecf01bd3385db21ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211bd86b-a1f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1618936834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618936834, "uuid": "acdf6103-de4b-47e9-922e-4fdb77704079", "comment": "Malware payload (NanoCore)", "value": "f8c7a160021dadadf0f2de06e9ae4c9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618936834, "uuid": "f6514660-285c-49d7-b85b-49f3eccee320", "comment": "Malware payload (NanoCore)", "value": "36e65f673182e9e1ee432cbbaa441e9d670a4882b725f2018669779819edf18d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618936834, "uuid": "5c9f27a8-0c92-4fcd-bc7b-f505c4ad28cf", "comment": "Malware payload (NanoCore)", "value": "26fda1cfe9d1b0f26380d3d55ffe3e2209c2853f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618936834, "uuid": "53547cf1-1450-4865-9403-49bb1fef7ba0", "comment": "Malware payload (NanoCore)", "value": "f9cca7ead007dcefe4f488ffe72d3a95102a2fbab37b921cf2e7694912150e758b51a650d25a452238416ffb34028ce0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618936834, "uuid": "eb8d23c6-7922-4628-a9ce-5b66c6c07220", "value": "98259D306E936B48E43DCF70B52042409FFAF94AE725DF4D7FB819981E66A0187917B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618936834, "uuid": "4b2b4518-248f-41c6-8c73-b73df3a7bdde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618936834, "uuid": "2cc6fc7a-377c-425e-95a7-12c212a81896", "value": "12288:kEpKI+SzRRRRRqIvXx+OX9KtgsQgsl2eu0irDipHNnbyX5:kAKwRRRRRqe+RXQgeu0irD8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618936834, "uuid": "6c82fca6-260b-4eea-bc0e-ea336dcffa9e", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618936834, "uuid": "3899e5c4-9ace-4364-8c62-32510087e421", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618936834, "uuid": "90030df3-bcdf-4308-85cc-1efa59fe0c72", "value": "ProjectOrder22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64540494-a1bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618911607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618911607, "uuid": "31cde44e-14de-4b97-b023-be65d0bd4f8c", "comment": "Malware payload (Dridex)", "value": "23337d6b023e5bfb551f2ba9a16deb72", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618911607, "uuid": "b5b38331-e3dc-4d70-8408-5ac0b0381dd1", "comment": "Malware payload (Dridex)", "value": "371732d35b5a0a071e5a2ffa66274594c1c6a35e3391a3cb885e2ccc9213b320", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618911607, "uuid": "c22c2e86-dae9-4385-a3bc-3a2546c1568e", "comment": "Malware payload (Dridex)", "value": "f55490ccb992db6b81b3517cb0a5c52e061a313c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618911607, "uuid": "ba44be57-f56e-4b79-ab07-c0ded2f6b072", "comment": "Malware payload (Dridex)", "value": "f3c5a367ebee20276c0c06181ea0e4ef99feba199d4273c68c3a80b8e44586393f0f0db8b3362ed20643f5a13485d8c8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618911607, "uuid": "2c2aa6f9-2977-484d-9998-24471ffb07c7", "value": "E5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618911607, "uuid": "cf841cb1-1402-4903-8caf-87e06020a792", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618911607, "uuid": "e7050259-099a-4b67-9131-a8be9fe3d25f", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618911607, "uuid": "9fea6998-3428-48f0-8727-3dcf4ba5d82b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618911607, "uuid": "4e7e1081-a9e9-4715-b3b6-8f7c275a42f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618911607, "uuid": "5259e6d2-243e-4514-8f48-4e7e23ada801", "value": "371732d35b5a0a071e5a2ffa66274594c1c6a35e3391a3cb885e2ccc9213b320", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d689c5fd-a203-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618942293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942293, "uuid": "631d14a2-f725-4e74-8b08-26e88342b47a", "comment": "Malware payload (Dridex)", "value": "fbf56a20f240f40c9871254cc6c43673", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942293, "uuid": "de5648e6-60b3-4d1b-8133-2f1c6d7501cf", "comment": "Malware payload (Dridex)", "value": "3725a18cb50844c9da7723d2ea1b5bd0c30f401676110aeae72ca8326129ef3d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942293, "uuid": "41b09b81-69e7-49cf-bd0b-c8693a3535e8", "comment": "Malware payload (Dridex)", "value": "16b0102bf76cd2363cb7a365bca18bbbf81d25a7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942293, "uuid": "108bf292-eeaf-4b49-bb56-f0c047d4baf6", "comment": "Malware payload (Dridex)", "value": "28858cbaa954a298da78d8782c515589fae04204125fcda5212651478741556a1df7eb812b4c54c392133c855ad34686", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942293, "uuid": "3ba9fe6e-13eb-41d2-bd12-7230433d2afb", "value": "E0F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942293, "uuid": "9f98df06-06a3-4724-a59e-3e0fb6605d33", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942293, "uuid": "50a31f2b-fe9b-4221-837f-e11a01757a31", "value": "3072:WwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:WwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618942293, "uuid": "e0083a8d-f69d-4ab0-a92d-fe40349ed1eb", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618942293, "uuid": "4f5558ee-c511-4be7-b51e-797d14eef57e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942293, "uuid": "a2cdbd91-ee15-461d-861a-e1147d5dc86b", "value": "3725a18cb50844c9da7723d2ea1b5bd0c30f401676110aeae72ca8326129ef3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9ac1c5-a1c1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618913612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618913612, "uuid": "291c6fb7-0594-4024-a852-58d738be7d82", "comment": "Malware payload", "value": "b4e7a9cdbd72320f2721c36fb21324f9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618913612, "uuid": "11faeaa7-9ee3-4783-afdd-cb0f53edb7d7", "comment": "Malware payload", "value": "3756065efa0f902c433676e92128f140b96026f0bdccd38e7aeeac3be37c8f6d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618913612, "uuid": "f692fb03-2666-4326-8329-1e0e1c20039c", "comment": "Malware payload", "value": "c0ea74245914bf7cec0e8ea8c720b724529b1de1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618913612, "uuid": "1303791c-4f99-43b5-b07f-655023c6021a", "comment": "Malware payload", "value": "23d2da1d8fc2d756468d6123aeff78f047d6e8e0506cbcbdefa00b908e0fdf5cd2b822227b5805e04fefc67cf728aa13", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618913612, "uuid": "3e2007d3-3dc9-48cc-b36b-3c40fe89ce46", "value": "02D37C5773A530F8E1768175C8A11A06F776B8751670CFAF03908A5A1F276A0AD3EFB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618913612, "uuid": "affe6f66-a6be-4b65-96e2-731c51285a60", "value": "c2c0bce4543274b09eb6c6231ba27e93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618913612, "uuid": "c3cde592-52f4-4445-9cf9-65072840cb14", "value": "3072:aK1khYLMFbrOZboV6OfqOgUx9UP/DQ4jP6vDlx/eGVJ:1b4xrBE3zUx9UPFjP6WGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618913612, "uuid": "cb53bc1a-667c-4703-a671-8a6b3fb351c2", "value": 134656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618913612, "uuid": "574b5611-034c-460e-b442-1e88b20b76f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618913612, "uuid": "bcc007d4-82d6-4859-b705-4f4bfc52fcbb", "value": "SecuriteInfo.com.Trojan.GenericKD.34358913.13726.12521", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ba8ed6-a189-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618889723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618889723, "uuid": "86627ee4-c0c1-42a3-af72-a7fc70a423fb", "comment": "Malware payload (Dridex)", "value": "5203a4ee8d7755e9f1a0c9c51bcc6277", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618889723, "uuid": "b20d7864-b724-4087-a0fb-b24195318cd4", "comment": "Malware payload (Dridex)", "value": "376ade173c9e0378a4486b54b2fc33ad8f0147dceca29fa0c6828062187c3644", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618889723, "uuid": "18b8e27b-199d-4213-ac8d-90b7ce324f62", "comment": "Malware payload (Dridex)", "value": "3c5d2a9e577ec62e4bd21b46fbab786e70140d0c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618889723, "uuid": "da6bfb4c-88fc-44d1-b34e-9a14ecadf0b5", "comment": "Malware payload (Dridex)", "value": "6d9b163d2824c10770d8dc58770c765991761381022f1c2ca0ba10281d826f96d0fc3a516081367cdb3fba4ae9aeac61", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618889723, "uuid": "0cca5358-dea3-41d4-b59d-779e3d768329", "value": "4BF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618889723, "uuid": "586cc1fe-bd46-4839-8dad-23e96918b033", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618889723, "uuid": "106627e4-db3c-4a08-9b53-d640a1fb102b", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618889723, "uuid": "87a8bc2e-f9b0-46db-8945-43b6aac074bf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618889723, "uuid": "61bf83f9-cb80-4f02-8f63-f0a1541c80e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618889723, "uuid": "ffd83c9f-30ab-4233-a1fd-38f22a536764", "value": "376ade173c9e0378a4486b54b2fc33ad8f0147dceca29fa0c6828062187c3644", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2afd610a-a1f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618935563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618935563, "uuid": "a5e2d2cf-aa61-4ce4-84a3-a72fe943e01c", "comment": "Malware payload (Dridex)", "value": "f0deace5a8012845ecb9094c249120cd", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618935563, "uuid": "3cc6c855-fe2a-4834-a9c0-24688b84c432", "comment": "Malware payload (Dridex)", "value": "376cbc8cd58e0a3a304a2193594f4a95774e69f79cb3bf53f36293316ff1a811", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618935563, "uuid": "21141f9a-481a-4718-a9b9-806fab2c8440", "comment": "Malware payload (Dridex)", "value": "370b7a2abc260226994c09e64dfaf1e4d512f35b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618935563, "uuid": "e21bed48-0d0e-4b32-b68e-cdf528857d33", "comment": "Malware payload (Dridex)", "value": "2d251673850492a4a62acb830eebc9c7ace6a6a2c4d84a9b309334b21328218c1399eeed2395e1de019a01fcd20b23e8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618935563, "uuid": "670d6aad-cfc5-4dba-ab56-9d5bbfeec910", "value": "B2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618935563, "uuid": "f31f6e5b-a983-4850-b499-7bfadc859a39", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618935563, "uuid": "dbe8561b-a4e7-4b88-ba3a-1c554f2cf079", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618935563, "uuid": "ca0bc695-7133-402c-9648-c0fe486660d7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618935563, "uuid": "091510cf-eeda-4911-8beb-5aa147e65700", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618935563, "uuid": "7af0789e-7ea1-45d7-94c3-f3c1a58ee869", "value": "376cbc8cd58e0a3a304a2193594f4a95774e69f79cb3bf53f36293316ff1a811", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7a272e-a1d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618923705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618923705, "uuid": "aa8a0f27-049c-4096-9044-51f44bd6275d", "comment": "Malware payload (SnakeKeylogger)", "value": "f800c3f06fc079a0b96c979a887c4000", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618923705, "uuid": "6f0ea597-4114-4f1f-9812-eb9bf79e255e", "comment": "Malware payload (SnakeKeylogger)", "value": "376fb5dbb339a77640a9ebc77162ab11c63186c48fa6f7c0a1717caacb9b70b6", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618923705, "uuid": "493afed8-93c5-4b44-9d2a-259376119b0c", "comment": "Malware payload (SnakeKeylogger)", "value": "ba0327ab0611bac6334c1b2fbda5a148dff52a6c", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618923705, "uuid": "0cebe9a1-a80b-40f6-8da3-0f3aee4e4d2a", "comment": "Malware payload (SnakeKeylogger)", "value": "b80d2a942f022e86d419e0d2a6a5f9928838b1e03c8487aecad1585fbc96d850ead94758be3e509cad7be46c0e9ad858", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618923705, "uuid": "044b839b-d887-442d-bfb8-c835bde26c7b", "value": "7F3402085E85D379E8A6DC79DDA3A2280339AD0FE5259A4BE10C7F9F71762EEF040075", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618923705, "uuid": "33d78418-555e-4672-be6e-73bd83ddcaf4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618923705, "uuid": "e126668f-6048-4905-ac16-943c174d6ea2", "value": "6144:US++oYfwTiTRFXJDtKi3CYIrSMKDlCvRBbkQ:7++oYfwyRJNtd3CYIrlWuRBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618923705, "uuid": "17475d33-5960-4baa-ad25-fca9d5abd08a", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618923705, "uuid": "cf440254-e79b-4efe-be77-0f444759e595", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618923705, "uuid": "5850feed-8a7c-4c01-9a33-873f439af922", "value": "SecuriteInfo.com.Trojan.GenericKD.36741716.4036.9128", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae5cc0c-a22f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618960876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960876, "uuid": "86b71af8-5f56-48d3-91d1-2549ff42e9b9", "comment": "Malware payload", "value": "06430dff2e358b5146e6a2ad7bd92c7a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960876, "uuid": "1ad00fb1-7676-4c05-83e5-1644ddac35e2", "comment": "Malware payload", "value": "37c9d274528bb83f13a410a395523f09d231f12925a6ca39460960c8d4866c27", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960876, "uuid": "7f8c8999-81a0-4983-b1fa-3a487188df3f", "comment": "Malware payload", "value": "e682aedc1c5dccb17ed7ecb162ff6bfc273d7e40", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960876, "uuid": "2e707c81-4bb6-4ee2-9b0b-e2ac25389f16", "comment": "Malware payload", "value": "43adcb1b53b096cd371c173de7a088e05eb4ec390da8715cc1db9dca4ae023cada34f7a68f76cecebb0c8a00e65d315b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960876, "uuid": "cbe436ca-6de6-4995-aa64-7bfa434a78b5", "value": "99F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960876, "uuid": "fa6ee07b-d481-4331-bac2-32d27cab7e8c", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960876, "uuid": "a50698b5-218b-413f-9f2a-363963edb43a", "value": "3072:WwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:WwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618960876, "uuid": "e962f123-8f3c-4402-8d49-367445e36836", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618960876, "uuid": "c676f236-fe0d-4878-a733-c90e7345e27b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960876, "uuid": "433a783f-2353-4522-8074-0daf52afecec", "value": "37c9d274528bb83f13a410a395523f09d231f12925a6ca39460960c8d4866c27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cb478b3-a224-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618956262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956262, "uuid": "42ccd0c5-ea0a-44ee-8e32-a0b426d55151", "comment": "Malware payload (Dridex)", "value": "8a7ec0022c7ebe2affe3eaae6d1c4375", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956262, "uuid": "c1f7d21b-fe19-439a-ae19-6fd96d857fff", "comment": "Malware payload (Dridex)", "value": "38204203a9900cb4e25117a0aed7240f470c6091f23f56bab5f00ac4922f5a1c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956262, "uuid": "f0efaa59-1005-45ad-9858-a56e61390838", "comment": "Malware payload (Dridex)", "value": "57a73b165e2b97309c402595064d9bfe80a7018a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956262, "uuid": "b59fe6d4-73ae-4a40-9e8a-9bc020ebb240", "comment": "Malware payload (Dridex)", "value": "a67894b300a8f7b0635b9a79aba9f6719890907816df0877c8780a727ddb1cb7bda0bf6040d02a40323f956b0c2d41e8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956262, "uuid": "cbb54bb9-9169-4248-af55-2893e8cb0499", "value": "96F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956262, "uuid": "4cf2c4b9-9aa9-4827-9597-a804b5399383", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956262, "uuid": "68bf50c9-182f-4724-b097-adfb4d4a7c44", "value": "3072:qwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:qwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618956262, "uuid": "4a67a6b2-9dfe-443d-9da1-484bb31cb6cb", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618956262, "uuid": "a3b4a7fd-9ddf-42ca-8d28-82ee657db2b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956262, "uuid": "c3f76f85-9082-4a62-8ff2-8c25565919dd", "value": "38204203a9900cb4e25117a0aed7240f470c6091f23f56bab5f00ac4922f5a1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df92dc9e-a210-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618947891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947891, "uuid": "06186372-0aa3-4fdc-8a93-595a1d645e4a", "comment": "Malware payload (Dridex)", "value": "3564308720a3331ac598c997a1b4b564", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947891, "uuid": "58a7337e-3452-45e3-b933-c6c4aa49e303", "comment": "Malware payload (Dridex)", "value": "3829010626a00778de748b5ca205c099f92cbbbf126d7541531e43da961b6cb8", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947891, "uuid": "f379c836-63fd-4f6f-84ca-cd74294e8bf4", "comment": "Malware payload (Dridex)", "value": "4f34609bfeb254bcfa42432fc95428cc46aafb94", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947891, "uuid": "4553807e-d018-460c-9c97-1db1ee501113", "comment": "Malware payload (Dridex)", "value": "39721375840cea687eb4c642e98f2017275037deeadc29b980e1c4e3d98ecbea5ac88d5b10fe0384fd6891c780ba64e9", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947891, "uuid": "b8deaff9-e087-40ac-be97-3aec6a6372ce", "value": "EDF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947891, "uuid": "67c4a4b0-c21f-432a-a523-00d6f52d483a", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947891, "uuid": "8b61c979-2f85-40ee-8a91-dff1051049dd", "value": "3072:9iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:GeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618947891, "uuid": "471bdece-143d-4725-b6a0-a6e375a8565b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618947891, "uuid": "f22d41a4-71a4-4a35-ae2e-41fea83b2bc9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947891, "uuid": "a9a6dae7-06b7-411f-8af6-5ccfdcba3936", "value": "3829010626a00778de748b5ca205c099f92cbbbf126d7541531e43da961b6cb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c70880-a16c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618877174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877174, "uuid": "ad235cb1-1506-40e0-a1c5-1af5e38c7115", "comment": "Malware payload (Dridex)", "value": "a979001255b5ba2779668d9364466d98", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877174, "uuid": "b503b4bb-cfb8-4d8c-82ce-e44ffce6324d", "comment": "Malware payload (Dridex)", "value": "382b952514656c9c4a58b6bfce385d85d7fac8a1b27cfb190254b8486c4857e3", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877174, "uuid": "33e43613-620e-4894-a60e-70f0fe508c58", "comment": "Malware payload (Dridex)", "value": "bfd8a6e6a28627c19fc2e4808191353f589b3c1b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877174, "uuid": "8ad19bb4-7d8d-4ec1-a200-d59fb6efd17c", "comment": "Malware payload (Dridex)", "value": "ec682d2e232eacd8c42366072cdd2b13af5ecc627cbb11b3cb4ed04e18c6b4091ac84874647e474a57485d6147c3726c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877174, "uuid": "661df83c-34af-493d-a1d0-850992c8db80", "value": "1AF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877174, "uuid": "9ca6362a-d7b1-487a-8077-43afdf1cc1b8", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877174, "uuid": "94c17823-adb8-4f86-8bc0-e210747b459c", "value": "3072:lWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:l42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618877174, "uuid": "f4bba944-aeed-45fc-99ef-dd6c1143caba", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618877174, "uuid": "dba21151-d61c-4606-ba63-1c1a3634e8d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877174, "uuid": "3ea75585-cd11-44e5-864d-acd61230c7eb", "value": "382b952514656c9c4a58b6bfce385d85d7fac8a1b27cfb190254b8486c4857e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a3f2c7-a1f9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618937865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618937865, "uuid": "5f5a8955-8d24-4346-891b-83d3db0a4d47", "comment": "Malware payload (Dridex)", "value": "e13bb089f76040c198238e9d9fb5c310", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618937865, "uuid": "fefcb3ed-2b1b-45a7-9fda-4f50421cfc8d", "comment": "Malware payload (Dridex)", "value": "3839959c9760b7dd0c6e05e4444a4c8a171e39cfa18368100b0f9688ed14cea2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618937865, "uuid": "85d483ea-46aa-4d71-ac52-229f46e1a99b", "comment": "Malware payload (Dridex)", "value": "d915b72a910ccb7f50e338bd8d0f00e00ef15cbc", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618937865, "uuid": "1c3df7f6-9a67-41b6-9c0f-07d47d64c2f4", "comment": "Malware payload (Dridex)", "value": "aea95c3c335227f03706ac17adc1b978adb8958930e8ca134086201cda29de97e74b0d1a7b6c9ea3359fefbfe52fbccc", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618937865, "uuid": "5c23f365-9755-4670-9234-83b9fe75aec8", "value": "D0F3D088CBB3E4E6EFB3D37966F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618937865, "uuid": "8d63fa1e-992f-4194-939c-4b824380e5f6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618937865, "uuid": "f9417105-c0db-4e29-8872-c3d9867ecdba", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618937865, "uuid": "4a725a04-85b3-468d-92c4-445dd4445664", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618937865, "uuid": "b5e777b0-f89f-4fae-b4ff-0db42fde7bd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618937865, "uuid": "238dc5b3-d55b-41a0-a5dc-215a2fdb4562", "value": "3839959c9760b7dd0c6e05e4444a4c8a171e39cfa18368100b0f9688ed14cea2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd7b4f4-a16f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618878578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618878578, "uuid": "50006bc2-0e45-42fd-bb15-7b81f4359eb7", "comment": "Malware payload (Dridex)", "value": "04743d13f361657d7676ec32b3a52b31", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618878578, "uuid": "4321a27d-c1ff-47a5-9f50-ff60872159b1", "comment": "Malware payload (Dridex)", "value": "386ced15aaba4f5dc8c61436befc2a7687a0fdbd8a15c0b4da725503fbdfd42e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618878578, "uuid": "5044ef48-4066-4099-a3cc-d5ca60ed74f3", "comment": "Malware payload (Dridex)", "value": "7f911233279cbca611b06a6cb16869703fa1d046", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618878578, "uuid": "672586a4-77b0-4eea-a403-41ae289ba511", "comment": "Malware payload (Dridex)", "value": "570957020e06bf5ecf7943d2604bb157631fb639877eb997b75855016bac0cc88545c5467128cae84e3afa5f1673c449", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618878578, "uuid": "3c105753-59be-4115-a8d5-c81cc3694c9b", "value": "BDF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618878578, "uuid": "b14fcf51-a21c-4221-b545-fe43d6a7fded", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618878578, "uuid": "049097fa-cf5d-40ef-bc73-fd4b3af1a112", "value": "3072:WiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:NeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618878578, "uuid": "e127f0d5-5722-4181-8865-c961cddf28e1", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618878578, "uuid": "f31e2525-f443-4231-9770-f16e2b1f2718", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618878578, "uuid": "c43e130f-a3d5-4fca-88da-c434eb3592ff", "value": "386ced15aaba4f5dc8c61436befc2a7687a0fdbd8a15c0b4da725503fbdfd42e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcaa14a6-a220-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618954812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954812, "uuid": "69ff5d0c-72f5-458c-a16d-3124950c7270", "comment": "Malware payload (Dridex)", "value": "2d2d56fc61bbaa6dff065421ce504dc8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954812, "uuid": "e3dd10a7-d19e-4cb2-a59c-61b5a8c0b3d9", "comment": "Malware payload (Dridex)", "value": "3899520daae506587b7e294972ee406e4249db280b0c9b5b753e240de1e1a6b9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954812, "uuid": "43c6f32d-0a24-4dca-a83a-9c174330e3e0", "comment": "Malware payload (Dridex)", "value": "a77890a2c1db6d826c6736dbc12a435ebe90e568", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954812, "uuid": "4f288695-9bcb-4ccc-97d0-b13375b9d6fa", "comment": "Malware payload (Dridex)", "value": "7261d8065558b40362f32728e2bdd5027534fffa4a9eb6653c71c64ac9a63dca6147f2868c52b3cee8cf40d92655e1bc", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954812, "uuid": "2e51b1c5-6962-46cc-a4cf-afd8037884dd", "value": "0DF3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954812, "uuid": "3767de86-a359-44d1-9661-3cd4890eb062", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954812, "uuid": "05cff15b-5c26-4699-be26-c321bdbaf57f", "value": "3072:vwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:vwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618954812, "uuid": "261177a6-a911-40a9-8560-672b5ddec05a", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618954812, "uuid": "bb772074-2a2c-4067-81e8-6ae2d36e7792", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954812, "uuid": "359847af-3521-4a28-aac6-1c54546b0f9a", "value": "3899520daae506587b7e294972ee406e4249db280b0c9b5b753e240de1e1a6b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e8e561-a1b8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618909887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618909887, "uuid": "8967f922-9d7f-4be4-9488-0b8c9ccba4bc", "comment": "Malware payload (Dridex)", "value": "54974849d975f315fafca5989a9476a5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618909887, "uuid": "8ad6cf8a-e197-41e9-8e63-61676611c326", "comment": "Malware payload (Dridex)", "value": "389d01c76bca45431ce58f98ef6eac2c2b46fa5a66d54e86445814a44de399fa", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618909887, "uuid": "c9b80dd4-27d2-4004-9af0-518a39063fae", "comment": "Malware payload (Dridex)", "value": "e83222cdbd575b6eea4a37f705c7516e2b353871", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618909887, "uuid": "d7d92e6a-9030-4de8-846d-c1a2ec9154dc", "comment": "Malware payload (Dridex)", "value": "a47b78ff0bab95b751f19ffcf2f0427901a723b5c19533950868f44dac38048b98ef787ad259af3b86c3c3f22fe1fc44", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618909887, "uuid": "ea3e0c86-3526-4a80-9f80-8a02991cb027", "value": "2CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618909887, "uuid": "e3218a80-17f1-4603-bd10-91142a30c716", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618909887, "uuid": "2fe76a1c-3cc1-42fd-af51-9eec938fa8e4", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618909887, "uuid": "38686d56-1439-438c-936e-0ad23ad15087", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618909887, "uuid": "7986fd08-c866-430c-925f-80284aa2cfb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618909887, "uuid": "4dd8c4de-f7b8-440a-89ef-ec9eb457407a", "value": "389d01c76bca45431ce58f98ef6eac2c2b46fa5a66d54e86445814a44de399fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d5cc349-a207-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618943915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943915, "uuid": "f1e293e0-eebc-475b-8177-dd126b0122cf", "comment": "Malware payload (Dridex)", "value": "e28d1bf4084ef35f239675c2451a0b28", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943915, "uuid": "b2fca739-5bf6-49d3-b7a1-b852e27a0f4e", "comment": "Malware payload (Dridex)", "value": "38b9490266303332d4bcb32f1f35e5df84bdc2d504d2196b385809bb923234c9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943915, "uuid": "52741eb9-95d5-4510-8686-414de67469e8", "comment": "Malware payload (Dridex)", "value": "4a8e06fb4640a45eaa780780f82778057ab46635", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943915, "uuid": "d56aed35-f8eb-4c0d-b426-0b5281ec0fe7", "comment": "Malware payload (Dridex)", "value": "e008b6a01dad330a7d742ce4adc3245306da381ad679cd958464fdf7a97a8bc5a800f1c1658760579321678160cefe9f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943915, "uuid": "c01a55ed-b8cc-44b6-872f-b5279b9baca0", "value": "0EF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943915, "uuid": "2fcc41eb-5172-44fb-ab5d-28a6a941419a", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943915, "uuid": "20ad4bab-216f-4058-a192-2c272f0b6aaf", "value": "3072:IwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:IwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618943915, "uuid": "c41bedd9-86a6-4db2-a7b0-4e759e6c2083", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618943915, "uuid": "2994fadb-c380-414e-bea1-96f615847823", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943915, "uuid": "b1548a86-e7ab-4caa-a037-bb5751df0bd6", "value": "38b9490266303332d4bcb32f1f35e5df84bdc2d504d2196b385809bb923234c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a98d209-a205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618943024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943024, "uuid": "0c9579e0-04aa-4ef1-9ee3-e29616f73bcb", "comment": "Malware payload (Dridex)", "value": "43d1a14680b4b9cfe920fb156199a9b1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943024, "uuid": "43455ed5-3d4d-4950-bbbf-2b4b8fef2a09", "comment": "Malware payload (Dridex)", "value": "39769774edde9271c711573cfc52dad5c0dd4f4ee399e0f7ced32de96a637156", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943024, "uuid": "787a231b-aaef-45d9-8a05-dad37f3c4fdb", "comment": "Malware payload (Dridex)", "value": "420730be8e367e8c4ffb8e382d5a25d1ff3f9f62", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943024, "uuid": "1f1da16e-ee85-41af-84ab-81ea2c9cc5a1", "comment": "Malware payload (Dridex)", "value": "148d9b0fd0e24912803df111bdc1dd4d4a946b93984fe079264559df326ec02cac0c18b1132aa3f5c89662bf59ba307c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943024, "uuid": "dc94ba27-6899-4d27-8c36-658921270196", "value": "0EF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943024, "uuid": "c2be3717-1a3f-4fc1-9939-13a5e6d38b51", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943024, "uuid": "c5eb9ed3-b70f-4257-abb2-db88fe20824a", "value": "3072:5wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:5wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618943024, "uuid": "476bb07b-259a-4d78-a340-01c569766583", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618943024, "uuid": "66891944-c2a7-4047-85b3-6d9a63368b37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943024, "uuid": "2cac93c0-49d6-4332-a6b9-a1298a656393", "value": "39769774edde9271c711573cfc52dad5c0dd4f4ee399e0f7ced32de96a637156", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e36b196a-a1cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618919981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919981, "uuid": "bac669d3-d169-42fe-9807-edd1722a9963", "comment": "Malware payload (Formbook)", "value": "2e2eba416b6ec3efaace0621e8e229d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919981, "uuid": "b3460809-5617-4efc-bfa7-3c49fd1daf3a", "comment": "Malware payload (Formbook)", "value": "398e6661f5ca757d0d7c777a0ed8ca1481b5c2df810008164e1f51deefc2ab48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919981, "uuid": "5efd6654-54d0-4a7b-84fe-9aa07471da8f", "comment": "Malware payload (Formbook)", "value": "c638e91299adc8ff3e0e21120e9417feed819861", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919981, "uuid": "69c287c7-f14a-4529-9c50-d067f589b68a", "comment": "Malware payload (Formbook)", "value": "d934cc0f9cd45e9c99405c868d611083c0185ce15af8353b5e10f981d1d5d4b38de3ead88f9a56eda7045c6e185495f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919981, "uuid": "528153dd-0606-4637-b776-b3a22e2beaa0", "value": "BD741215B864C630DA21DA33E9D242540F60BE0F6822CA97E94DBE0F32FB3CD7569752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919981, "uuid": "849934ad-a00a-44df-85ae-044d1b7950e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919981, "uuid": "953079a8-a29e-4375-8354-75a3fa59c49b", "value": "6144:8KZILKzg4fZdCh5+8b8OGVXifJ1CQ13U2bSKIFHj+iLVy:XZUKzg4BdC68b8OGVXifn1m2OF+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618919981, "uuid": "d5da23d8-6295-4508-9915-1a4a8b57af21", "value": 341816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618919981, "uuid": "bbee0db9-32a8-4be5-bc97-61c5752ce481", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919981, "uuid": "58ee82ad-8c4f-4b15-9cce-cd6367d77aac", "value": "2e2eba416b6ec3efaace0621e8e229d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f5c43f-a179-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618882748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618882748, "uuid": "a591b33d-b1ad-4d14-a625-b0745debfbd1", "comment": "Malware payload (Dridex)", "value": "e8295faf14983aee21f44bb5f58b6a95", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618882748, "uuid": "174c0626-d8df-45a2-b916-3fdec43f3754", "comment": "Malware payload (Dridex)", "value": "398f536efab32b3afaa684758ab9f1fc3546d69ea661a201d3dfb4612654db45", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618882748, "uuid": "8ecf9899-f55f-4410-a012-622183ea7823", "comment": "Malware payload (Dridex)", "value": "ad34ca221ab8df5fe7b9d76da77cbb107c6b55b4", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618882748, "uuid": "fbf630ae-d732-4e56-9963-6e5144e379de", "comment": "Malware payload (Dridex)", "value": "fbe86a9edae0d3596cf87c478842b6c57bf04597936299d98b87af492490a4b020e042ef9b84b8f685796b22ef7e9dd3", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618882748, "uuid": "a62a99db-15d3-4e5b-bfe5-cf2c15bd0e1d", "value": "76F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618882748, "uuid": "988098b7-4905-4f18-87eb-2f21bcd746da", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618882748, "uuid": "2ae09abb-c980-446a-be1b-85f48a50dfa6", "value": "3072:ciFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:/eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618882748, "uuid": "5f5c14f5-4d4f-4849-a12d-514b7a754315", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618882748, "uuid": "90c1cf17-eebd-45fe-abe2-8de041907467", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618882748, "uuid": "348ab0f7-4b0a-4e72-8e7b-7078fc7d1121", "value": "398f536efab32b3afaa684758ab9f1fc3546d69ea661a201d3dfb4612654db45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab19bb9d-a210-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618947803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947803, "uuid": "8abe30b5-8f50-4eca-a129-8bc919f2868a", "comment": "Malware payload (AgentTesla)", "value": "2b0d60816fdd08f8f82852e11086b633", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947803, "uuid": "91f6ac9b-f376-4d8c-a7f4-a26b8dcab065", "comment": "Malware payload (AgentTesla)", "value": "39ad4248a5f721de8e635ddaab76190a0bb6bcc48acaf31396c5489ea1aabd9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947803, "uuid": "6c7f4255-7ad5-4391-a6ea-24a1367d7acd", "comment": "Malware payload (AgentTesla)", "value": "702c554daee025edf44a970b0c3bc23c49a1f0df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947803, "uuid": "94d35fe0-bf9b-43a3-a268-c724230e8e6b", "comment": "Malware payload (AgentTesla)", "value": "c79c31d086a458c58ea3d3159331ee69abba541fcbff84a7641d1331532ece827ff25580d2c04410281a9af2b87b2666", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947803, "uuid": "3ec4a240-2375-44fe-a221-aa3bfff24f2e", "value": "D8F4332D48E9B8FA9BC2AFA00854C6090D7B7D15D72AABFF0F43C5ADDD5DD42109C898", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947803, "uuid": "590a0292-c294-4bad-b17c-ca810df33789", "value": "12288:OuO2c5JgFn/hbkT+oPqjf2KwLl8JnJstZTRYygUnK9h9SrGjt5:w2c5JgFJE+mqzpLstPBgUnK/jt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618947803, "uuid": "2cb8f174-4914-4395-aba6-d84fe5a75185", "value": 787119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618947803, "uuid": "a11cb4cc-d9d2-424b-b0e9-50a0a2bc982f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947803, "uuid": "8aab80ce-dd97-4002-b643-1404a135a569", "value": "HCM - JACKSONVILLE, FL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cbf1469-a1fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618939968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939968, "uuid": "d610a30f-3a11-4281-99b7-db58e30ea62a", "comment": "Malware payload (Dridex)", "value": "274329dd48bf7aea9d49143af99fbf88", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939968, "uuid": "1aaabca6-1f29-4636-954a-5c0676a4ced4", "comment": "Malware payload (Dridex)", "value": "39c06cc8fe9e529a519ba175dd69a1e6e4d9698a0de02ed02ccd40f8491694d0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939968, "uuid": "5bad9723-d67c-4b37-a4bf-c362fc489e79", "comment": "Malware payload (Dridex)", "value": "21eaa0feeff4fbc75ff8a03de2de7559379f00ed", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939968, "uuid": "b5b4a712-8923-42ba-b0e1-36d984ffaf8d", "comment": "Malware payload (Dridex)", "value": "378a5c6e195f9e5f43fd2b8e35b9e87ae3970d9b9dec0d24193f768c7d3e55a7a85a2121b187de246e50a8f49c9af251", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939968, "uuid": "43605cb5-1ddf-48d6-9fa0-50ee05f20eca", "value": "7CF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939968, "uuid": "3c4dfe9f-a3ec-4fd0-8428-09da99858fdb", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939968, "uuid": "820fe776-1222-4a3a-9acc-846f914441d2", "value": "3072:0wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:0wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618939968, "uuid": "e053cd88-df8c-450f-ae61-eeb153e48587", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618939968, "uuid": "56c11d2f-a175-4e5a-bb03-cc5a6ec90048", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939968, "uuid": "7d0c91a9-9904-4aa9-825a-8bdaf630e62e", "value": "39c06cc8fe9e529a519ba175dd69a1e6e4d9698a0de02ed02ccd40f8491694d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb3a92cb-a1e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618929443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929443, "uuid": "dadc1ac3-d856-4976-8d09-7f6d811fa0c6", "comment": "Malware payload (Formbook)", "value": "eb8bef3bcdb0a68f7b8e5ed7d496b4a6", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929443, "uuid": "667cff43-8dff-4bff-be82-49368f061102", "comment": "Malware payload (Formbook)", "value": "39c3cb2bce96c98cde9bec9fff034acca99b592f0a4ebec39a6017f3554a56fa", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929443, "uuid": "40036c68-f0a1-4352-8945-9a7c60f03ffb", "comment": "Malware payload (Formbook)", "value": "1dc1a5acebc8e846ee100ca14817e4a6a18380a3", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929443, "uuid": "254018db-a5e8-4169-867d-9c0a2e8c9058", "comment": "Malware payload (Formbook)", "value": "4a3cc044232e562950218891988df51318ddd2aabb928f89717871663f6c12d45a0c1e07cb69d5e5be5af2c02796062e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929443, "uuid": "631c3542-2b5c-434b-b05e-a829a977d6fb", "value": "93C4230BC25C5D15BE708A591E589222097FC62DBB323959C253AEA12C0D3FFC9DE5DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929443, "uuid": "bf8a1f43-6da1-4ecb-a3d3-c1ab9bc11809", "value": "12288:z40uogjZubvSK+YrrC6Pcaw9M9oscPprWixA:MUgjZmf+gC6pw9x6iW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618929443, "uuid": "c483c8cc-814a-44bd-8533-e425e5eee0c8", "value": 579903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618929443, "uuid": "1be79169-fe5a-4b62-ae75-53b3d360dccc", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929443, "uuid": "2c38d176-5423-4afb-9ec5-23f081fffb09", "value": "Invoice pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17093d1f-a208-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618944119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944119, "uuid": "b4fac2cc-7254-46b8-b26a-2c616fe97adf", "comment": "Malware payload (Dridex)", "value": "416aeb0f2012be2610b28af1e4396249", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944119, "uuid": "ef4575de-b00e-435d-81d8-8661922712fa", "comment": "Malware payload (Dridex)", "value": "3a28b4f47fbd3b039c9c7a5ff3bfeddf0caeac647d3bff5cf527aee077e87ca7", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944119, "uuid": "b2552399-181c-4d1c-9ff6-c579c1b94ffa", "comment": "Malware payload (Dridex)", "value": "a06f218e6d22e9c2f09fd233b9d1552d5d63a6a9", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944119, "uuid": "05089d33-50c5-4514-97b5-e64fd04b7429", "comment": "Malware payload (Dridex)", "value": "a82e14cfb5dbbb94d3585e72ad6823f278ded9d368fd751a0c339bcd6b4aeddd8e5f7a47784aa63fb5884431b3cd5e6b", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944119, "uuid": "ed0a823e-6512-49e0-95d4-27edc1a5eb45", "value": "17F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944119, "uuid": "ec311869-06eb-4887-8a55-bac9adb06676", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944119, "uuid": "e1003ac4-b158-4be7-8ff2-2c2e4bf64377", "value": "3072:yiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:xeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618944119, "uuid": "8f2ce0bc-f14c-4c32-898b-e63a58462bef", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618944119, "uuid": "0dae99a1-76b7-4b64-b4e4-199013048239", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944119, "uuid": "c526edf5-ead3-448f-8440-f387b053c19a", "value": "3a28b4f47fbd3b039c9c7a5ff3bfeddf0caeac647d3bff5cf527aee077e87ca7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de83d7a-a213-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618949070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949070, "uuid": "f96b62ae-e2d2-46c8-a558-9d93befb2710", "comment": "Malware payload (Dridex)", "value": "2bd8c510afbc9b784bb447b1ef5340ad", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949070, "uuid": "3725dbfc-d805-42bc-8dc5-8ce65b3ef3ab", "comment": "Malware payload (Dridex)", "value": "3a36ed70bc5feb4c7690a6f1a4002817b059e404f22a808e8d3e70127f8a3bf2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949070, "uuid": "4f193807-153a-49ac-8c82-5e9a5121cb5a", "comment": "Malware payload (Dridex)", "value": "37ca103aa55ad8d36015816df53c9e22410f1f58", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949070, "uuid": "0fe82553-16cf-41e9-8d28-c5a7ac0a5312", "comment": "Malware payload (Dridex)", "value": "098d192b04d5033d1dd5ff0ad6ea1353ddf297e24598629bacd8c3533ec9aa35eeb6c6f535c18b1686c3974375baae04", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949070, "uuid": "7c928cd9-1427-41ad-b95f-756dbb00fe25", "value": "8FF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949070, "uuid": "707cbff8-4598-456b-81e1-ce1d928de84e", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949070, "uuid": "f7b4614e-6d65-4c5e-8886-c42d0f45d3db", "value": "3072:/wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:/wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618949070, "uuid": "cdd83968-7aaa-4ea8-adeb-5bfd5b557e76", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618949070, "uuid": "ef272289-fb50-41c4-b2f3-2659c8de9551", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949070, "uuid": "e7feb5e0-ec3d-4b32-a625-443dfd6b22b3", "value": "3a36ed70bc5feb4c7690a6f1a4002817b059e404f22a808e8d3e70127f8a3bf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5e91bd-a1ff-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618940558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940558, "uuid": "fcc96e03-f0f8-486c-9e5e-a7745f9ccf40", "comment": "Malware payload (Dridex)", "value": "09e5d8b0c03fedcf08ebb3e0831b1fb1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940558, "uuid": "9c566a8b-7666-4f3f-88a8-e697ed187311", "comment": "Malware payload (Dridex)", "value": "3a4e4bacd53df596e61547cc876b4d6bf892f38307205ce4112c393d71b87b5b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940558, "uuid": "5a17b9e9-b728-4ab1-ba80-c74391063f15", "comment": "Malware payload (Dridex)", "value": "543a3c58fe7579cc64c106b89b2d774d95727acd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940558, "uuid": "c24b4be8-75c8-46ac-9e75-6f13629e8660", "comment": "Malware payload (Dridex)", "value": "f3950080b5228839dab0becfbb0d4e50c357af0f53eacb6c98eca56a97007f92f2f98b4d45a1586ff5088c428784843c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940558, "uuid": "5dfc9873-1d04-413a-8098-5eb31b7ac0bf", "value": "C8F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940558, "uuid": "b3287968-8679-46ff-a50a-44421f6f207b", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940558, "uuid": "edf66dd8-1f1d-400f-bba5-194947a59c66", "value": "3072:QwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:QwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618940558, "uuid": "fce095b6-67d8-4154-866a-a73fd28a83c5", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618940558, "uuid": "844527be-70b6-4752-8e24-5e30808b0bed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940558, "uuid": "522b5edb-84eb-4495-a5ce-27a28833ebd2", "value": "3a4e4bacd53df596e61547cc876b4d6bf892f38307205ce4112c393d71b87b5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea0c982-a211-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948051, "uuid": "d98b79db-322d-43f3-9c1f-95ec9b98cb31", "comment": "Malware payload (Dridex)", "value": "329b5410333d443f8df4276df63e633d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948051, "uuid": "bcdc02f8-dd76-472c-a4c9-988f82305fe5", "comment": "Malware payload (Dridex)", "value": "3a8dde79621cbc95312422c1047bec21993ad26832324bb63f9ee8ad8615302c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948051, "uuid": "030e4765-54d8-43e7-8b62-92b1b2d70cbe", "comment": "Malware payload (Dridex)", "value": "00ca09282453e0e4d529735ccf8cddef953bcc6b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948051, "uuid": "48262255-6cd1-490f-9179-8b0ca72922cc", "comment": "Malware payload (Dridex)", "value": "65dfe47942ee6888d7121de293b89fc640599146a4ae638f59f7dd90b9d6c464b41cb46d44965371091c9e0005efdf93", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948051, "uuid": "918796d4-21fd-4a09-a357-aad6d21f651f", "value": "4DF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948051, "uuid": "8da67b85-a83c-4fca-9f41-0baad792f111", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948051, "uuid": "1e73d4ac-fea2-43a6-b0f6-daef98e3a510", "value": "3072:wwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:wwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948051, "uuid": "43b9a252-c2da-41ff-bb11-b2b7ec47642b", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948051, "uuid": "848f50ac-4ec2-4099-85c1-84759ff2d948", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948051, "uuid": "2999a678-c128-44df-8ff1-b68b4f7446ec", "value": "3a8dde79621cbc95312422c1047bec21993ad26832324bb63f9ee8ad8615302c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac210f9-a1cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618919832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919832, "uuid": "426cfb8c-0005-4b92-8cf4-ac422e106ce8", "comment": "Malware payload (Dridex)", "value": "44a795b3a2db1392bcfbd5c5080e3900", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919832, "uuid": "0e5c3c66-1301-4ee3-95a0-51972a8cbbe1", "comment": "Malware payload (Dridex)", "value": "3a9dda6c42d8263fb0abd7caf17acb7157cf485eed3dc86db38250d9d98e894b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919832, "uuid": "0f9a5224-1ed0-4920-9d34-f30f0fca6f57", "comment": "Malware payload (Dridex)", "value": "ca441703c38cf49d3f189a723a2cbd32196bb1e5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919832, "uuid": "9374600e-1575-47d0-b46d-6df181fd35d0", "comment": "Malware payload (Dridex)", "value": "1f639af139ffe75a76369f5d5e0506434b0c4e3386cd431d9ae2bd727bfc58f73c5504abc4c8b348b76da3b940bd78e3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919832, "uuid": "edfa166d-faed-48a7-97dc-0a3778c4eb24", "value": "03F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919832, "uuid": "e04f82f1-5b90-473d-b4cd-791e743d4cd4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919832, "uuid": "da3d5a0d-213a-4f94-9687-70e5dfa5b2a7", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618919832, "uuid": "dd90344b-d8da-4363-9308-de78c2c8e0a2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618919832, "uuid": "685e75d3-f0c9-4525-806d-3d417666d3f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919832, "uuid": "e5a2a6c7-9865-4e6b-9288-852c8822076d", "value": "3a9dda6c42d8263fb0abd7caf17acb7157cf485eed3dc86db38250d9d98e894b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a0a57d-a203-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618942129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942129, "uuid": "d2d647ee-e07e-4d0e-8cee-e6d2f139d4ba", "comment": "Malware payload (Dridex)", "value": "cdd5fec45944c0a61840ff1224888f73", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942129, "uuid": "8acf47b4-2961-44d3-b7b6-48c26becc426", "comment": "Malware payload (Dridex)", "value": "3adf641966e06b6b95baa1b4d6f32e09eb4bdb4015d6c073062ca1375e78973f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942129, "uuid": "1370741b-2667-4634-b078-d80e2d0d5db3", "comment": "Malware payload (Dridex)", "value": "3c5b910723a1348b63a1e743a76ca5bb1eb7c868", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942129, "uuid": "9109a7b0-f10c-44db-ab6e-7a9ff3d679f5", "comment": "Malware payload (Dridex)", "value": "62483acd2150862b97798f6e59c0bb76d4ec542c908c1ff73047834eb21d82e7874a95e84e0a7c210ff28e9291d79122", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942129, "uuid": "f76296d2-5cea-4f36-9622-3dcd512bb92c", "value": "11F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942129, "uuid": "d6f65ddf-646c-4b9b-83ed-d5793de468c4", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942129, "uuid": "96abc420-b9c2-4f51-ad07-d3d904817feb", "value": "3072:PwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:PwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618942129, "uuid": "b59f2c14-c894-472c-abb2-e90a9813eccd", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618942129, "uuid": "f5043507-d2b0-411b-b70e-f93e9c888de0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942129, "uuid": "848d06fb-eedf-4ef8-a33f-f3fd826602ce", "value": "3adf641966e06b6b95baa1b4d6f32e09eb4bdb4015d6c073062ca1375e78973f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "295721a6-a1ff-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618940284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940284, "uuid": "4e4df6c0-6506-4f74-ae48-c350eaff3741", "comment": "Malware payload (Dridex)", "value": "84f28895649d4e14761a9d80b2f63615", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940284, "uuid": "8a00afe2-e037-4e60-8132-4844b816c94c", "comment": "Malware payload (Dridex)", "value": "3b10d3f0837b4f5f7959b03e14f3320d602c4b89a0f62888463d5a2e5dd1f9c9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940284, "uuid": "a4bac336-d5f3-43d9-b60d-b811293ca13c", "comment": "Malware payload (Dridex)", "value": "02e6eccccd0185fc448b289fe657998416bab9c8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940284, "uuid": "7e341198-364f-42cd-af8b-675113fdabea", "comment": "Malware payload (Dridex)", "value": "21017edaeb2d082d59a0fcc8a553252898a061a7752be25e2346d54ede0792e64392617a2c2ec593720057dde90a9195", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940284, "uuid": "4034353d-c365-4c8f-8535-6e4d9d4b2eac", "value": "36F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940284, "uuid": "b03bfbba-680f-4fce-b3d6-77503ba33ea5", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940284, "uuid": "a88bf96d-8869-4ade-a1e3-16002cd67464", "value": "3072:2wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:2wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618940284, "uuid": "ae4124bf-1915-46b9-b529-0db8bb020829", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618940284, "uuid": "aa605791-7d31-4024-b46d-2833b1c787a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940284, "uuid": "6a03a2c0-0d05-4aea-9b51-f63fb18e0b0b", "value": "3b10d3f0837b4f5f7959b03e14f3320d602c4b89a0f62888463d5a2e5dd1f9c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db9d4b0f-a1ee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618933282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618933282, "uuid": "7d03067a-c5b2-481c-90e0-ee3580d52c35", "comment": "Malware payload (Dridex)", "value": "139648a21f262777bbbc43b9515d0f4b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618933282, "uuid": "f65a8263-f1c0-45f6-8d3c-e53755885262", "comment": "Malware payload (Dridex)", "value": "3ba6300773ec5e8a9555783db9054c5e863c10436dd6356c586549bf71a48e07", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618933282, "uuid": "8eb39e4d-9cd7-4ff5-941d-1e86ceeae0b6", "comment": "Malware payload (Dridex)", "value": "dbeb3da289aa80e324b703acfcc05c317432dc7b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618933282, "uuid": "222be7ec-1623-49ec-bc26-36972d3ae3c2", "comment": "Malware payload (Dridex)", "value": "f46b01b627db611556ccd861c2162590607245bca3661e424523448e903de3d0f5f3853a0c8e7418920a0a2981faeb8e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618933282, "uuid": "b19505f6-256d-437e-8b57-8daf9416e84d", "value": "1FF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618933282, "uuid": "0f33174f-6754-4804-b439-56960931e186", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618933282, "uuid": "f345f1db-357e-40fd-879a-87ac957a8363", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618933282, "uuid": "e1fba908-6081-4047-968d-4eb89b51f6d5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618933282, "uuid": "9099dfb5-e911-4a3b-828e-54d593cd2b0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618933282, "uuid": "47396c41-6906-453f-8186-9b88d70c3186", "value": "3ba6300773ec5e8a9555783db9054c5e863c10436dd6356c586549bf71a48e07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28e0152-a1fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618939763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939763, "uuid": "1405050d-0f3b-49b0-868e-63c3ac003245", "comment": "Malware payload (Dridex)", "value": "07d6c0a6c69b5caae612f9cee307efeb", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939763, "uuid": "939695f8-70b4-4b9a-b7a4-788df02c87b9", "comment": "Malware payload (Dridex)", "value": "3bcf2f75571bf685df8c76fa5c2dd26d1b728a9d7f5d17181720d85df8ac11b5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939763, "uuid": "581cd332-5b31-4e0a-887f-d73b7eba6b68", "comment": "Malware payload (Dridex)", "value": "1aabaf5ae0138682f7d65fe0f862b0466a4e5a8d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939763, "uuid": "58a3e7fc-383c-4d16-b223-9ec251ffb933", "comment": "Malware payload (Dridex)", "value": "606f5b9d5956aad8c5d1476fe0e10ce1fc6e1a37f5e8f477cf5c2492a8a59eabc6949e8524db620ad2f3f92dba88f3fb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939763, "uuid": "6f63119f-b57a-457f-a4d0-eabbc5b48b5e", "value": "40F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939763, "uuid": "961130f5-34d3-4f92-b46c-ccf4d7631ea4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939763, "uuid": "aa7dc5dd-d2b5-4e55-bd35-37edac84ecdf", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618939763, "uuid": "2b11df80-bcc0-4646-bdc0-82d33ac72dea", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618939763, "uuid": "98e6b515-4e55-4c74-91df-9c9169977717", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939763, "uuid": "bc913594-d443-44d3-83af-d10b70e83b23", "value": "3bcf2f75571bf685df8c76fa5c2dd26d1b728a9d7f5d17181720d85df8ac11b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a826326-a1fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618939830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939830, "uuid": "df699543-517d-4b36-9cb7-d734f1366234", "comment": "Malware payload (Dridex)", "value": "c6487a28d36c19f794b5c658f1f35a22", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939830, "uuid": "c01ad70c-33ba-48c2-9162-a65532db316a", "comment": "Malware payload (Dridex)", "value": "3bdf7ef5346702084777fe52af6800a7f6b3d28c722196c4dfeeea455b5699f8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939830, "uuid": "187304da-7944-4271-9e3e-4400644bdded", "comment": "Malware payload (Dridex)", "value": "8bcdfe957531bef4de1243a00760e81644fe5f10", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939830, "uuid": "d0429496-721a-4788-ba97-fb436505e221", "comment": "Malware payload (Dridex)", "value": "3568749d79f145a786b857ef1016404ec307950137abfad5b360540ab958289e262dc47ed6e9fd2bc8c62cb53868f761", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939830, "uuid": "3e2c7ac7-85d4-453e-83e6-a00a6029451e", "value": "74F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939830, "uuid": "243c3ce3-a6a4-489d-81f2-daac38fb6638", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939830, "uuid": "20f418e9-04a7-4467-9b27-c6e576ec33a6", "value": "3072:awZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:awZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618939830, "uuid": "83397635-ee1a-4713-b055-17d1e5751b6f", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618939830, "uuid": "42a14b16-f0e3-41b0-9274-66d0421d79a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939830, "uuid": "5be367f6-c1fc-4725-8212-a1f53494f181", "value": "3bdf7ef5346702084777fe52af6800a7f6b3d28c722196c4dfeeea455b5699f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4599280c-a204-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618942479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942479, "uuid": "f8946b10-a013-411d-8522-c65bb5315816", "comment": "Malware payload (Dridex)", "value": "f935d8afa09b76234d497eb95d902d6e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942479, "uuid": "6f5aafad-45ad-44f6-98d1-e5ac50743746", "comment": "Malware payload (Dridex)", "value": "3be45d2debe7a2d8c68813db406d113a43a84484866cade8d3f0daf2e714458e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942479, "uuid": "2db3865e-3ffd-4f14-92b5-88c99460cf15", "comment": "Malware payload (Dridex)", "value": "6586cce7d75d33a1aace9378f9143c7b46cc5ee5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942479, "uuid": "e213e361-e720-44ac-9b61-2bf829168530", "comment": "Malware payload (Dridex)", "value": "8ac66818c8f1bd1fa2a0b2b19cb0bbcdb303eefb92f3f6da968e145e97216dee04b0311380c453dd80c45c358d7eb882", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942479, "uuid": "f8c1409d-7415-40d8-b1ca-81914b7239d7", "value": "35F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942479, "uuid": "e95fe5b9-aa85-4784-af00-7a8497a862bf", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942479, "uuid": "aab2ac21-6338-4255-9be7-cfb8296373e0", "value": "3072:8wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:8wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618942479, "uuid": "dd783515-33d4-4eeb-956e-f53dc54bcd12", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618942479, "uuid": "223efaf2-a5bb-45d4-8c3d-47b80b3152f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942479, "uuid": "6918e607-8c6f-4303-b3ce-2407eb31f52d", "value": "3be45d2debe7a2d8c68813db406d113a43a84484866cade8d3f0daf2e714458e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d646ae-a1e0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618926969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618926969, "uuid": "d8d3cfe1-6724-42be-b8f2-3e0730ad1d46", "comment": "Malware payload (Dridex)", "value": "22b2f951b2557e2d07924dcd4916cec9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618926969, "uuid": "ef9e7087-66c4-4832-bde7-95a93deff4ef", "comment": "Malware payload (Dridex)", "value": "3be91d4dfe130ce66035d29ba04953d8efee5f65cf80a4cf6df986729c74483e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618926969, "uuid": "62536895-86f1-423b-b060-051c601f864a", "comment": "Malware payload (Dridex)", "value": "0df90fc0b281983cb70325ec62bdda539614df1a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618926969, "uuid": "f58a4371-a9b0-4f15-8762-614ff1421c6e", "comment": "Malware payload (Dridex)", "value": "61392d6788ec88cc4093e9e9eb8cff7c0604631ca52ce17cbaaffadd6b120a0aadfa5a3ca8a78fcd83c46c0e669192bd", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618926969, "uuid": "4591a1b1-3ed7-46b0-b2eb-e09da35bb5ae", "value": "F4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618926969, "uuid": "b18cf431-6717-430e-8002-48b5af55b76f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618926969, "uuid": "c493b419-fbdf-4ad2-98db-38a4ef35b4de", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618926969, "uuid": "906d3abc-0ace-4638-9225-ce3d6191fc1a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618926969, "uuid": "a290d5a3-3114-4d85-aa37-6f0bd26f4d75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618926969, "uuid": "3e949aea-2db3-4f4b-b2da-38c9862aeb16", "value": "3be91d4dfe130ce66035d29ba04953d8efee5f65cf80a4cf6df986729c74483e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc77089-a22c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618959565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959565, "uuid": "082046e1-8a4b-479d-8332-5f0f74d08e94", "comment": "Malware payload", "value": "92cb0293114e005206f661860f88d916", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959565, "uuid": "26f76ee3-65f0-49a0-b20e-0a51a44fda28", "comment": "Malware payload", "value": "3be9f83eb055adb542d0d115b1c5ccc17785bfa2955c554d67316f5d2adc47a5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959565, "uuid": "5fc1cdc3-3911-43c6-b78f-424a837211a1", "comment": "Malware payload", "value": "7acd0ceb310f397a773dbf05ef4f8d9b51221ef2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959565, "uuid": "c87e4422-9868-428d-82ba-d63d25026cb1", "comment": "Malware payload", "value": "1dd8c9b78d3c0a7abf77f6113ec539419738a4d6e9b3d84727345d7f0e10351e893d7ae52c9b24fcad537db56b3c058c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959565, "uuid": "56c900b8-3c05-4c26-b122-6b60c7ebfc7a", "value": "77F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959565, "uuid": "85ff44e5-0aed-423f-87e9-2ac6dfdc4e7b", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959565, "uuid": "50a0c88d-3c5a-4ffb-b54d-7932dd445eef", "value": "3072:lwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:lwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618959565, "uuid": "63698253-c265-49b1-9163-2eb38983b2e7", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618959565, "uuid": "88949710-aef8-49f5-8aba-fdc1f1d40f14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959565, "uuid": "51132eab-8225-4778-91c0-32035c5a2858", "value": "3be9f83eb055adb542d0d115b1c5ccc17785bfa2955c554d67316f5d2adc47a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1b226c-a206-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618943238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943238, "uuid": "e67d4b12-1ad5-425f-b2eb-56baba6dd125", "comment": "Malware payload (Dridex)", "value": "0a51f0a906dd509b5e65e6544ddf0719", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943238, "uuid": "3cedb99d-1ded-446d-ab2c-dcb463fd630d", "comment": "Malware payload (Dridex)", "value": "3c1f019690c68e4fae6884ce39649f972316f7b5aada20884de7a488bb90db91", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943238, "uuid": "19c550fb-7071-48bb-a4af-5b247aaefc28", "comment": "Malware payload (Dridex)", "value": "8ede15fd1f29f1f09655a623b6475e302d5cd571", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943238, "uuid": "e1275634-4638-4f5c-b859-34a2e7aa7cc4", "comment": "Malware payload (Dridex)", "value": "50e10dfda721fa3b8975182024758515f413bd04f2faedadf01b37b6cc6890af1144db718bec22ef9508ac0c60dc4e00", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943238, "uuid": "cff8d2d7-5558-4e38-9b20-a8099e18769b", "value": "1DF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943238, "uuid": "9f5845cc-f0e0-46b3-857d-09a032d0762a", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943238, "uuid": "3627b603-ffdd-4671-ba50-b447afed28e1", "value": "3072:/lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:/lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618943238, "uuid": "3cbded1e-b983-4195-a075-305ddbb83b8d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618943238, "uuid": "facba3d3-3be4-40d4-9494-57008b5c11d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943238, "uuid": "639e3cf0-2db8-4776-8c61-652896fa0800", "value": "3c1f019690c68e4fae6884ce39649f972316f7b5aada20884de7a488bb90db91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35af51f-a21b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618952542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952542, "uuid": "849d0b77-326a-40a8-9b8b-7220a8a0ff24", "comment": "Malware payload (Dridex)", "value": "f907388dc2a9a53ee727398bf1f8f915", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952542, "uuid": "69264d2f-5433-4f75-8b65-78bd1e337568", "comment": "Malware payload (Dridex)", "value": "3c92add674e7331789f8bc281d2fdb21550dd4c26de00eb38dcebf789f908d91", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952542, "uuid": "90d1afc4-431a-43d9-b0fc-604c1a774f60", "comment": "Malware payload (Dridex)", "value": "52c64407170586c6ca816e90207b82d73308a22c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952542, "uuid": "53595efc-2579-4850-8614-b03557cff67b", "comment": "Malware payload (Dridex)", "value": "c9188517c9c09fcb3388d4780bf6a366e83fee4be42dfdfdcac8da3d5282ba5a51e2e260df4498b91f6320386f64fa12", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952542, "uuid": "97ea1c4c-26af-4654-8c1b-148b8a2fc815", "value": "D8F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952542, "uuid": "01ec9718-a3c0-4ddc-8c5b-fc43c795f4b6", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952542, "uuid": "23c1b493-8bb7-45ab-a57d-1f6d027d57d6", "value": "3072:0wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:0wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618952542, "uuid": "9177c397-34f4-48d2-8cce-0837cf3d8beb", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618952542, "uuid": "10f19c51-f860-444b-8130-c773bc8399c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952542, "uuid": "6e4cc1c3-259c-4ccf-a2bc-285d90bc9949", "value": "3c92add674e7331789f8bc281d2fdb21550dd4c26de00eb38dcebf789f908d91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196073bb-a221-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618954860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954860, "uuid": "80e10203-f25f-467b-9174-15aa93334775", "comment": "Malware payload (Dridex)", "value": "dfc1d05ee9c5f80a450a9bc760c38b86", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954860, "uuid": "91debb19-d9e5-48bf-b148-419d589b9b4a", "comment": "Malware payload (Dridex)", "value": "3ccc3057025577e498a54ec51075e4bd5e31cbd467baa9ca01a78b9877b4d998", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954860, "uuid": "bb8a5dd7-f8b1-40c5-822d-9f28c79815c6", "comment": "Malware payload (Dridex)", "value": "2ec7f40841e995e08dbd3a6c1cca9e1760ad81ff", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954860, "uuid": "4a0e6513-e4bd-4131-9351-ab75b65f91e7", "comment": "Malware payload (Dridex)", "value": "236f518177b402d2024f9b21e7d7104981081fe9ccd81cb9b7a12b3c32dd100a400d2618b4467bf0ff99e53eb741a0ac", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954860, "uuid": "74ba8e1f-8593-4375-a89e-e417e350c764", "value": "64F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954860, "uuid": "dbd19f79-63a8-40de-9316-5f632ee21df2", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954860, "uuid": "08f98fb5-5099-4ac7-9706-5e2cdad60e3a", "value": "3072:owZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:owZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618954860, "uuid": "17e20316-4c55-4974-964f-541dbb83c1f7", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618954860, "uuid": "a5eb26a3-032e-4723-827f-63c469e3be05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954860, "uuid": "ffcb18dd-f7e8-4b86-89c3-365176d3b1de", "value": "3ccc3057025577e498a54ec51075e4bd5e31cbd467baa9ca01a78b9877b4d998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5882026-a20b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618945700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945700, "uuid": "89908722-61b2-49c5-a2f9-7e40c244a98c", "comment": "Malware payload (Dridex)", "value": "2a6b416cb8e9b9af65cc96d3a3c12028", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945700, "uuid": "75160c26-98de-4771-835b-a44d93074fac", "comment": "Malware payload (Dridex)", "value": "3cd5d2716eed7bd34cb8dbed164fb3b1b132a27f99de0311bde4f019966513aa", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945700, "uuid": "104b1c6b-f514-42ad-8ac4-91759c72d54b", "comment": "Malware payload (Dridex)", "value": "1292d4936dc2d2c39fbb408d1a92e002919889b1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945700, "uuid": "c8947b17-d783-4e42-8e25-12a5defd551d", "comment": "Malware payload (Dridex)", "value": "054d62721759ebe2505382a512e5fe05709ecbd5b9315960934b2b19d889797b03e11335ae8de2690460352609f15a0f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945700, "uuid": "03b2e5d0-ff31-4be4-9ea1-0f7153704a13", "value": "B9F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945700, "uuid": "083c1df1-3e88-4aef-9650-4eaf48b7a0a8", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945700, "uuid": "4437e2cf-e643-4a46-8ccc-8d527d5ac7ca", "value": "3072:0wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:0wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618945700, "uuid": "4609e62d-cf94-4ac7-9a57-96bce44170bb", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618945700, "uuid": "b207e2f7-675b-4237-a21e-e34ffa2d7489", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945700, "uuid": "79958af6-2a69-441c-9c3b-fcd6f393fc9e", "value": "3cd5d2716eed7bd34cb8dbed164fb3b1b132a27f99de0311bde4f019966513aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd63000-a211-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948343, "uuid": "65702406-e124-4a42-8175-a197fff31329", "comment": "Malware payload (Dridex)", "value": "c2d762611590a5f127d69658db215ef7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948343, "uuid": "6dc19044-156c-4da0-9218-1f7acadb2493", "comment": "Malware payload (Dridex)", "value": "3cf7d5ec5de4f7953be3ca199cbc939826c6310e0c584973efdea75cb018b0ce", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948343, "uuid": "c618cc7f-c916-4eff-9484-a9a449cdf70b", "comment": "Malware payload (Dridex)", "value": "ddc4ccdf225de7452d0137a24ecd28e8029fe2eb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948343, "uuid": "3109ec73-5c79-4fb5-ad06-1a25d281002b", "comment": "Malware payload (Dridex)", "value": "d9e8b070a7789cfbce66bb7cc874e4b2932ca62771f28ad49febc099d30c8c6a39480f5c7a8ea8c9039ba92e90d1c779", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948343, "uuid": "e0a2018e-9e16-4576-8dba-aeb82d9894a1", "value": "54F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948343, "uuid": "5531d605-b47f-459a-a43c-de9ee46734a1", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948343, "uuid": "838d1ccd-a768-45fb-92f9-161cae8d8809", "value": "3072:fwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:fwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948343, "uuid": "0c1adc01-cadf-4059-b251-20ef31202fb4", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948343, "uuid": "0255586e-0a5d-4f77-90d2-519b3300ac35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948343, "uuid": "e021e82e-e0a6-4f98-a407-cbc80687d5b8", "value": "3cf7d5ec5de4f7953be3ca199cbc939826c6310e0c584973efdea75cb018b0ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f87c08a2-a179-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618883079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618883079, "uuid": "56d05dcd-b297-49c6-b97f-57b3cd1dda63", "comment": "Malware payload (Dridex)", "value": "75fc9f9e82ec4e3fd342621576c90e7a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618883079, "uuid": "ca32aa72-dbf1-4d1c-8264-9cafde5d7d9a", "comment": "Malware payload (Dridex)", "value": "3d6bbe73a2543bbdbabcc608956ad087d80c2cf2c416230390fcb99547494883", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618883079, "uuid": "95a9e6c6-a8d4-4f2d-bb2f-993b46e8b3c5", "comment": "Malware payload (Dridex)", "value": "11500464babfd12eaa7ce9446d17d9df51e58e14", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618883079, "uuid": "dc2ddc08-3ce3-488d-a929-7a55eb7635a7", "comment": "Malware payload (Dridex)", "value": "b53ade6776deba1086de40a49b1db63743c36b6be6f734e5b0cb170ad7809064392970afc4b5ba769f85044bca0bda61", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618883079, "uuid": "d36cd9d2-c1e0-4249-99ae-428e33b2de6f", "value": "2BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618883079, "uuid": "b4e141c4-8c77-48a1-938b-c4276357aae4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618883079, "uuid": "5f378c0a-9f47-443b-ac48-98a18b164ea2", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618883079, "uuid": "d58c3000-d1f9-400c-807c-765fcdef4e62", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618883079, "uuid": "14db40ec-8365-43cb-bb5a-848687216494", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618883079, "uuid": "3ef14c77-1b48-43e0-8606-88af5b74cba6", "value": "3d6bbe73a2543bbdbabcc608956ad087d80c2cf2c416230390fcb99547494883", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6c9291-a227-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618957741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957741, "uuid": "7ff5215a-9f09-4a5c-b68f-790fd4827e14", "comment": "Malware payload", "value": "7a042ba83bf9cb8d4e81b02ec6c43007", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957741, "uuid": "e21a8da0-3924-4f66-802b-54755460cec8", "comment": "Malware payload", "value": "3d6c0d1f09623e76d0ecbc0a68f021acff09011ac263daafbb9d8ea60cc6466d", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957741, "uuid": "70de0467-edde-400d-93ea-b6535a742462", "comment": "Malware payload", "value": "b39716abb2fdb18c8e544216503e52c0d6ba7364", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957741, "uuid": "d9e13710-65ca-4c2b-979a-d0cc7ebd81a6", "comment": "Malware payload", "value": "d19632badae1c16859145eb9b7bd00daeb0bff3d1cbabbc20fa319125907436d232de5b9f4ee5e67ca3497efaa62d528", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957741, "uuid": "f8bfd1b3-8226-411d-a3d9-f0434ed2440a", "value": "47F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957741, "uuid": "d7904989-3eb0-4635-bf2e-5db3028f863b", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957741, "uuid": "29462beb-61e3-49e1-af7d-b9f26fca0072", "value": "3072:Olpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Olo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618957741, "uuid": "59a498ef-b86c-4812-94ae-7c7215cb9cef", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618957741, "uuid": "cbcb98bc-9033-4609-a219-020c0802f472", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957741, "uuid": "475fb881-d40d-496c-88ba-8fffbe3eed8c", "value": "3d6c0d1f09623e76d0ecbc0a68f021acff09011ac263daafbb9d8ea60cc6466d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7defe0-a220-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618954730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954730, "uuid": "c37c23d2-49f4-4772-83b9-9bddd78d5171", "comment": "Malware payload (Dridex)", "value": "7947c91e9f0282e1841a7f3cded881bd", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954730, "uuid": "9401d34c-a812-4c1c-9332-dafc45fca0a1", "comment": "Malware payload (Dridex)", "value": "3daea8dd4ad4b5ec8fa2c6c89b2c5e7f996de155cbcbae615edfbc8dd0293774", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954730, "uuid": "53fd7a4a-f980-4275-b867-44e8bd0931d2", "comment": "Malware payload (Dridex)", "value": "a2c63ae8cb839e7bea602de2d6b2d1576db804ea", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954730, "uuid": "3c38110d-4ba0-43d7-be26-f5c0bc1a353c", "comment": "Malware payload (Dridex)", "value": "eb9efe82034e7a5aa57a98caa1304130e40d35792343d77d4fd06213b2334341ba78568aeae8bcbb722b05c0efe6f7ea", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954730, "uuid": "544a3a38-6f67-4a71-8727-52f13ae7d906", "value": "FEF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954730, "uuid": "94fd55d5-d646-4751-a035-0dd520c5add0", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954730, "uuid": "a44855a0-5e2e-42b2-8382-625f952d9118", "value": "3072:gwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:gwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618954730, "uuid": "df850d10-4d14-48d1-a6af-0584a469286d", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618954730, "uuid": "5817b1fa-080e-48e3-978d-7cb9295a8fc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954730, "uuid": "7e6b072c-cbd3-4f1c-9f9c-1647be51dd95", "value": "3daea8dd4ad4b5ec8fa2c6c89b2c5e7f996de155cbcbae615edfbc8dd0293774", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51e5af7-a223-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618956034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956034, "uuid": "201bdfc7-2cd2-49ed-93fd-1ad39b21c4e4", "comment": "Malware payload (Dridex)", "value": "5fa3d53802f4a6c7d095ddc5f5e5633b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956034, "uuid": "9513b7ba-4f36-43f9-a47b-54b05e72f45a", "comment": "Malware payload (Dridex)", "value": "3dd31e54989966329f36cb6556e45f72e3b97d409d808af40cb8dc31aa6f6ae4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956034, "uuid": "9219a444-5413-4055-9dc8-8ffa3c826895", "comment": "Malware payload (Dridex)", "value": "fe16fc9f37b787cdaf794af578c35054ce70c1d6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956034, "uuid": "744de709-e9ca-4174-88fb-2a4dc71d9f3d", "comment": "Malware payload (Dridex)", "value": "da919d16189313a51a66ccb272c2e700aab4dbbd555696064e4471ba35fa0a6c15d6365ff29dbfef626a395772934b5f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956034, "uuid": "5c7d1073-16fb-4f12-a205-79d48c83434b", "value": "F5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956034, "uuid": "4dcfcc9f-6dcc-425c-9f3d-dc932bb2d3ba", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956034, "uuid": "a41a16a3-71b5-4934-8bcc-4e12500162ae", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618956034, "uuid": "2acefde3-98c2-4b75-b22d-3c833db1f9d4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618956034, "uuid": "69c67b1a-71eb-4e92-81a9-4b5d77575419", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956034, "uuid": "312d24d1-7330-47d9-b666-dabb580db6d5", "value": "3dd31e54989966329f36cb6556e45f72e3b97d409d808af40cb8dc31aa6f6ae4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a062f9-a17b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618883737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618883737, "uuid": "649be523-19b7-4303-978b-6997ecc5602d", "comment": "Malware payload (Dridex)", "value": "081231f89af1a2601e857eb05f076842", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618883737, "uuid": "5562b404-e5d3-456d-b08b-4d37a1c17488", "comment": "Malware payload (Dridex)", "value": "3dd7613269e36fd91b09b7b3e0779808b93d8094eaeba88195e548667e43b51b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618883737, "uuid": "52bd3ca6-afca-4cf1-8163-63fcd41ee0a5", "comment": "Malware payload (Dridex)", "value": "f496571a35f82ef8db413e574bfb6e189ccb4553", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618883737, "uuid": "78d5d6dd-6c89-41c3-abf1-0deeaeb72162", "comment": "Malware payload (Dridex)", "value": "7f85dfb3b3665e9e69b5a0406a300f38833a405d7599c8f2ed2dbf5e87c4d99228c991648404f9dec5d3d4dca5c7f9ac", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618883737, "uuid": "c601a230-8ba9-4067-a5cf-adda65a35d0a", "value": "2AF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618883737, "uuid": "ef717b59-2e84-4a0f-b02c-e3b8447d5f8d", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618883737, "uuid": "1684e74e-3101-42c4-998d-d19b04a13493", "value": "3072:Nlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Nlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618883737, "uuid": "82c1a3dd-5e36-43e9-a0b7-5b3f90793e5b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618883737, "uuid": "1af49e75-863b-49a5-be74-79611803b63b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618883737, "uuid": "0bfcc335-1b29-4109-ab16-d4b8ed2fdef7", "value": "3dd7613269e36fd91b09b7b3e0779808b93d8094eaeba88195e548667e43b51b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e153055-a20b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618945607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945607, "uuid": "ba288672-4626-44bb-ab9c-58ac87b419b6", "comment": "Malware payload (AgentTesla)", "value": "410bd9644a7a26eb0aa075ab4d1da1c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945607, "uuid": "cbd1edcf-3608-451a-8f92-96c5221ad500", "comment": "Malware payload (AgentTesla)", "value": "3e43c18ac9756f3a055b0298245af2d9cf18503ba7ee32d92300993e90c29a80", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945607, "uuid": "f456f709-91eb-415d-b48a-d5a42700a791", "comment": "Malware payload (AgentTesla)", "value": "29114c55af7aa06dcd8bfcfac14920789ff8e25e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945607, "uuid": "0e1da466-02e2-4d54-8a61-9745e1c53d62", "comment": "Malware payload (AgentTesla)", "value": "ae3b3e308842b399f7f55dac4f0b645013f2b6e3d95d333989de5f336ae502b17b3e884d2a718330a04fd687d1b45d56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945607, "uuid": "a6bde9f3-3046-4307-bd46-20167a27de8f", "value": "82159D302E576B48E43D8F74B42142845FF6F94AE721DF4D7FB8099C2E62A4287917B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945607, "uuid": "e31b671d-0b5f-4ea3-b212-264bb1dfc8fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945607, "uuid": "a0efa2cb-0463-4984-8682-f57afa0a88fa", "value": "12288:2xMc9FzSzRRRRRKFCapgJDyZmw+RI1c5DvGg/DP6cu4eNYSLZd5:Q19ARRRRRKFCapoDyZmxQ/Oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618945607, "uuid": "66acce89-2583-4482-8830-276ec145aa6b", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618945607, "uuid": "fd830a33-360f-422e-95c9-569883c35235", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945607, "uuid": "6c2a2013-d697-42f5-98b7-7d7a8f2731b2", "value": "410bd9644a7a26eb0aa075ab4d1da1c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee882b92-a224-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618956506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956506, "uuid": "1284075f-2135-4a9d-9b32-8c1618755d08", "comment": "Malware payload", "value": "b068fc825c1dddb51c556002d0583ed8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956506, "uuid": "f4b96179-e0c4-4748-bd1e-8d0c3621d0ee", "comment": "Malware payload", "value": "3e85df47907936dfa769c0af27d53e4baaffb0d62da6cd08333e6c902d089647", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956506, "uuid": "f5220bea-6345-468d-b4e3-098c7c913b12", "comment": "Malware payload", "value": "33d4b127d938eea4cda797c4b4007ee9f5629ec8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956506, "uuid": "f452b967-9136-41d3-923d-8bf2df2108e3", "comment": "Malware payload", "value": "d8ac9b7cd5bea3560930e518aedeab6bb96d11ff56f9b5c67a7fadf2681f57a2290157397ccec4d89bfef98c78a51070", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956506, "uuid": "af680bbf-209a-4631-865d-40a22a1cc9c7", "value": "D8F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956506, "uuid": "53d295e1-6b35-4a2f-b11c-1e566bf1e96f", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956506, "uuid": "e53227cd-1d33-4936-895f-afa4564b847c", "value": "3072:cwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:cwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618956506, "uuid": "78585b93-f861-44e2-8785-0c95d79bbcc8", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618956506, "uuid": "7346e097-3ff6-4fde-af64-2cb1bc2d28c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956506, "uuid": "e84f160d-7376-4f43-a8d4-a5ed72e7f276", "value": "3e85df47907936dfa769c0af27d53e4baaffb0d62da6cd08333e6c902d089647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382b941c-a225-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618956630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956630, "uuid": "8b2da032-8cee-4e68-bb32-2ee22219e013", "comment": "Malware payload (Dridex)", "value": "e3c530eee79c147c7fca9261ef2039fc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956630, "uuid": "f35db1e6-6ac5-44e8-ac23-b392638654ed", "comment": "Malware payload (Dridex)", "value": "3eacf7d5ff61321175d620065e53e90eca7ebca53a641e7f96a3f9ee60730404", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956630, "uuid": "7a3522c5-64fe-4c26-871d-6206912bd891", "comment": "Malware payload (Dridex)", "value": "e4d11a0e1e2d9df416279c3c66a5fee0050568c6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956630, "uuid": "21414ce7-3501-4e58-937c-95e172dbf9b1", "comment": "Malware payload (Dridex)", "value": "ec4e183ecaa841cead62663bdc0ca7d7c584a3d59db2e1d2b4e2c41f8f7a916518652759b82e2cc0515fd17f4233436b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956630, "uuid": "fd131905-5586-422b-98a4-527c6ff35234", "value": "D8F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956630, "uuid": "c8479c40-e648-42da-9662-d5202d6f9ab7", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956630, "uuid": "c7ab8ce6-7e62-41eb-b498-c5798da8cbe6", "value": "3072:MwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:MwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618956630, "uuid": "1730153e-0bba-4155-a42e-50b92a604f79", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618956630, "uuid": "a45b9597-1c33-4474-b7cd-1174b2a6fad3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956630, "uuid": "744b66a3-235f-45ca-84b2-185cc606b375", "value": "3eacf7d5ff61321175d620065e53e90eca7ebca53a641e7f96a3f9ee60730404", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564d60cf-a224-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618956251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956251, "uuid": "91b4c904-a7de-4cae-9e59-5e69ab21582f", "comment": "Malware payload (Dridex)", "value": "dc4b8902ac73894b8f9801e454b112a0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956251, "uuid": "1b31aa2a-d7e5-4fe8-ba64-422a1deaab75", "comment": "Malware payload (Dridex)", "value": "3edd2f72535e9652c65fa8d4f019af08933324bdb91f2a4a14daee708f46b1cf", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956251, "uuid": "c24eb274-3ef4-46f7-993e-8e32893a3a89", "comment": "Malware payload (Dridex)", "value": "a94130324db47171ee464b7603a5acdf4f56a581", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956251, "uuid": "cb7cc1f2-6056-4dfc-8821-19788c776c81", "comment": "Malware payload (Dridex)", "value": "e275235d1f72dbea739e43765f0baa893ef83529876061b4df40033ec6bff1b07dc59f144cacaf04feae610d45568289", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956251, "uuid": "4fbea471-2b48-428f-b4c8-06f645531fda", "value": "F1F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956251, "uuid": "1e034ee3-2d1b-419f-b69d-8510a8a79193", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956251, "uuid": "af21bef2-c7e6-4f0d-ac32-3459f054af28", "value": "3072:/wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:/wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618956251, "uuid": "bdb3f15b-6bf1-4a0c-99d3-62e3cb03e8cf", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618956251, "uuid": "5c4d8a3b-5c46-411d-878a-bdb5faa30ee9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956251, "uuid": "3a250bfe-07cd-49a8-94f6-0bc644c1174a", "value": "3edd2f72535e9652c65fa8d4f019af08933324bdb91f2a4a14daee708f46b1cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611dd7b8-a22c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618959705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959705, "uuid": "b3ee8521-c235-4c33-905d-f16a211266bb", "comment": "Malware payload", "value": "57d4ec275072e70ffc03ca12405b92f4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959705, "uuid": "d08905e2-3c77-448b-a24c-733f758b17c6", "comment": "Malware payload", "value": "3f21812abaaf6ff4a6acc149dc426a84ae4414a59e135ba73324fbbec46714fd", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959705, "uuid": "e55cf460-6f2d-46f4-ab54-8a4013ea0db1", "comment": "Malware payload", "value": "8e1c0acc0745152a4f1c38ce961681b55ac5ecbe", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959705, "uuid": "28b18b2a-695d-47b7-ba9c-e4b6128ee0b1", "comment": "Malware payload", "value": "5bf288a10d546238aa0e549d780b116e94abd7d2cdff43978bba4c10bb0082dd08b0586359dd326ea47b2ed1e8d7c5c3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959705, "uuid": "e5448b7e-293a-40e0-a256-15ea251837f9", "value": "FAF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959705, "uuid": "1258f06d-d07e-4e62-92ef-ddede4bdbb15", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959705, "uuid": "41abcc92-b5aa-4fec-ae39-62e3e477291d", "value": "3072:kwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:kwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618959705, "uuid": "a4a4c374-e0b3-4b6a-a41a-f6da90827b60", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618959705, "uuid": "a8529c88-4416-4bb9-98b0-3160fb386db2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959705, "uuid": "0163f850-dec8-4f1a-ac84-383893c7425a", "value": "3f21812abaaf6ff4a6acc149dc426a84ae4414a59e135ba73324fbbec46714fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315fcf3a-a1cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618919682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919682, "uuid": "f8abc5ca-ff51-4c03-83b3-1b57250baf88", "comment": "Malware payload (Dridex)", "value": "0d392a08ad35149025eafe9d63c0104f", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919682, "uuid": "19893d38-0b24-4a7f-afbb-9c10559361f6", "comment": "Malware payload (Dridex)", "value": "3f3a01f72de016d69d2f20f999f6bf446a4dfbae6ff92614579d55e9a5e876dc", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919682, "uuid": "381194f0-7632-41f3-b2ac-58dfb12044a1", "comment": "Malware payload (Dridex)", "value": "d3e2ff39ee393a7bab350e996a75133d9f733a4a", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919682, "uuid": "7a6ff41f-ad7b-4954-ab59-63af534a3249", "comment": "Malware payload (Dridex)", "value": "6c90dc77947b3a6ab13a6e6b8f55a54b7b8df5f655f04536dfbd3e460b79ac8094351ec35873b939f9a83ad114350d39", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919682, "uuid": "5e165c9f-7d28-4090-b525-2291d11873df", "value": "D4F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919682, "uuid": "45b985f2-1032-4104-a28b-b3d4829c4b32", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919682, "uuid": "76e493f0-b774-4b1c-9482-a80a8158409d", "value": "3072:viFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:keAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618919682, "uuid": "1a3f825c-3f23-4259-ba36-e552bdb58804", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618919682, "uuid": "2c79776b-3403-4a13-8cad-852403fd0cf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919682, "uuid": "467bdfc9-4f5c-4043-b31c-78779941c4e3", "value": "3f3a01f72de016d69d2f20f999f6bf446a4dfbae6ff92614579d55e9a5e876dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c114222a-a219-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618951706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951706, "uuid": "8be6d721-50ea-43a9-ade3-10b2ecb57b84", "comment": "Malware payload (Dridex)", "value": "0bc6e1fabfaccb82b02aeb0999977451", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951706, "uuid": "14e0b8c1-f76c-4f45-a4c3-e5103c7d2081", "comment": "Malware payload (Dridex)", "value": "3f3e971db7405ff3f4a282d7798cff708d668171762cc7f59e68a53d21a21d4f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951706, "uuid": "5a548a3a-9a31-400f-9edd-a20918876ef2", "comment": "Malware payload (Dridex)", "value": "5f067dd869cd1c58f003505ef99523750f353136", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951706, "uuid": "c24f72f8-19ae-4a12-90ef-081068682c51", "comment": "Malware payload (Dridex)", "value": "12cf501fec40286c8a79a9b5be7dd060aefd12ef0b6b31fc7e4b950380f413388d89f9d12414a47e6afb95db6ef06087", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951706, "uuid": "f67f2e9f-140b-4e22-b7b5-037f358fa702", "value": "FDF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951706, "uuid": "65c96e02-8c6f-49e3-b469-63d6bf941bf1", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951706, "uuid": "052059d2-a10a-4f16-acbb-aa1900cd5fba", "value": "3072:rpwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:rpwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618951706, "uuid": "fb035e62-d419-4824-90b8-29fb5053b263", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618951706, "uuid": "cbaf2adc-b8f0-433f-9347-61973d52dd40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951706, "uuid": "d961612e-43c7-4f2d-a434-9e185119f691", "value": "3f3e971db7405ff3f4a282d7798cff708d668171762cc7f59e68a53d21a21d4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d86a862-a22a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618958786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958786, "uuid": "6be8ac35-14a5-4505-a537-a7765e0016a4", "comment": "Malware payload", "value": "8429af7351b889a28245142d2a36dca3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958786, "uuid": "25cdf492-56ec-40fb-b6fe-80daef39408d", "comment": "Malware payload", "value": "3f54dc322ccf0d70433d58715ac945dfd3f0b37d064ff5985c026030f2480f6d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958786, "uuid": "40e04444-2f30-41d2-bfa4-7b4a1eb60cd8", "comment": "Malware payload", "value": "4468cfe2515b2c438292ec722baf6333486d7241", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958786, "uuid": "4975d961-f61e-47c7-9cfe-7b2e66ffb2d5", "comment": "Malware payload", "value": "d5730960cb63a51265e1801d04a3ac07b483f657e8490b05d6908d08707c8e25f614596dc8a3e0ceecaf504d75db3e2b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958786, "uuid": "b9e0aee1-a63a-4428-8c0c-20df895522dc", "value": "C2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958786, "uuid": "6ca54bb2-5614-4125-b5b0-8ac8f127b1d5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958786, "uuid": "dd683ac4-af30-4ec4-86c2-9d2cb53034af", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618958786, "uuid": "54530468-3276-4763-af01-2c7763310dfb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618958786, "uuid": "dbfbf316-cb36-4ae8-a858-4e6b01cfea11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958786, "uuid": "15103a9e-48a9-41f2-bb4c-95060b9c0093", "value": "3f54dc322ccf0d70433d58715ac945dfd3f0b37d064ff5985c026030f2480f6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f482f24f-a1ff-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618940625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940625, "uuid": "a29308cd-a4a1-4006-852b-95163ebdd680", "comment": "Malware payload (Dridex)", "value": "27aecafa137e014625bfc16f059bcad3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940625, "uuid": "0fada105-f1cc-4670-9a90-a76fe64b2708", "comment": "Malware payload (Dridex)", "value": "3f6850c97ca1434cd7f062d8284255ae1a5b4008f35f87a2c5f6e92825a2a036", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940625, "uuid": "7945941e-1993-487f-95d9-a50654e6178e", "comment": "Malware payload (Dridex)", "value": "8d4a8cfe9d74984104d7e22baeeb4a2be4179bd4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940625, "uuid": "25c015c4-60c5-4b92-b771-862f9345c6f5", "comment": "Malware payload (Dridex)", "value": "2a34612c4db12db07093b402fb991f67c39e534b398d5cecb4fb7ce628271801c0160d697a90eee6c869d6ed376c53b7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940625, "uuid": "22445e7c-e8a5-489c-aff6-df08316368a8", "value": "77F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940625, "uuid": "22fb14c9-e98f-4c12-aa87-15fc0e93dec9", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940625, "uuid": "c4bc95d7-3b9f-4f6b-aed4-b02b14e6e2fc", "value": "3072:kwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:kwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618940625, "uuid": "c08ea0a8-078e-4576-a7ba-1e35a0710cbe", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618940625, "uuid": "488584bd-002c-4832-97e2-bc225f58762a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940625, "uuid": "80845f17-d189-41fa-aeb7-2e147140c520", "value": "3f6850c97ca1434cd7f062d8284255ae1a5b4008f35f87a2c5f6e92825a2a036", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8222c3bb-a20a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618945158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945158, "uuid": "c935c559-6458-42d9-8e99-2ed066d14fa5", "comment": "Malware payload (Dridex)", "value": "1ca28f2246a9368360e90b4406926cce", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945158, "uuid": "51b3c415-e66b-448c-93a2-a33ff2d21a7c", "comment": "Malware payload (Dridex)", "value": "3f7bc3e733544ac9db8001f8bf365f4ed2305344dafa3ab60bfe1b5dd46b35c4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945158, "uuid": "ec1dee31-6c0f-499e-88b7-c4fe6e41c0a3", "comment": "Malware payload (Dridex)", "value": "93be77693f4f0f0eae6f91e5fdf42d018e06a7bb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945158, "uuid": "029d9616-9040-4ed9-ab3a-4a27dcec04dc", "comment": "Malware payload (Dridex)", "value": "82eff04b6ba3186ef715580c7de0a77059673b707c47caf58aefedba8379b4db3640c6b538c57ec131523b30cf9ac9a2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945158, "uuid": "04461d10-5656-4440-83c1-c72d5a956c5d", "value": "53F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945158, "uuid": "9dbb498b-890b-4faf-b7d7-3a06c4b6d11a", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945158, "uuid": "9a69fc1f-5793-4e57-a2e3-80d52797c9f7", "value": "3072:EwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:EwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618945158, "uuid": "b585fa81-99ad-4c27-8808-8ee3ac4ef14e", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618945158, "uuid": "0defa1bf-98c7-4e0c-8c98-54437393600d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945158, "uuid": "fd1cfb0b-460e-46d5-add9-0c34b75c8864", "value": "3f7bc3e733544ac9db8001f8bf365f4ed2305344dafa3ab60bfe1b5dd46b35c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33136f6f-a219-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618951467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951467, "uuid": "6eee9288-53b8-4a3c-99de-61edf545a547", "comment": "Malware payload (Dridex)", "value": "c32a5740d37adf36d663e7f3deab1c75", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951467, "uuid": "4e18172f-ab75-4ca0-80b0-7fe193e9ffa0", "comment": "Malware payload (Dridex)", "value": "3fed42dce636b6c25f162353ce1fccd3d83a89432277244861d277580276ddcd", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951467, "uuid": "bfed7b7e-d76d-4e24-a21e-fac42e5d38e8", "comment": "Malware payload (Dridex)", "value": "7dfad964a33a833b1eaf91b6065e098a050225c3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951467, "uuid": "23ddf8ae-a615-4b1b-99e1-e96315b6d03c", "comment": "Malware payload (Dridex)", "value": "63ba9a3b95a664410f659e66e2c7b7be50f6eff33da2264beac010d7ce091d788c63b2dfae428f9f64ff3511ccad95c9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951467, "uuid": "dd93febe-3dd4-4121-8433-7908470fcba3", "value": "AAF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951467, "uuid": "80e73635-0e59-4a4c-8a70-cf81fc23180a", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951467, "uuid": "b02d0961-ebcf-4de4-a623-fa7a3a6873c6", "value": "3072:nwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:nwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618951467, "uuid": "4c2b3b4c-c972-4b3f-944b-66b0afc9524a", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618951467, "uuid": "88e920a8-39b7-48e7-b4fc-5905364b9cad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951467, "uuid": "a830ef8c-7366-4707-abd0-9e6e60c8b617", "value": "3fed42dce636b6c25f162353ce1fccd3d83a89432277244861d277580276ddcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3832ef-a201-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618941175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941175, "uuid": "7f709b78-bc57-4777-ada5-f5d2d037ac1f", "comment": "Malware payload (Dridex)", "value": "b40ab554115cd6c9c58637ff25c503fa", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941175, "uuid": "27696c7e-b008-4bda-8f12-50b489257d3e", "comment": "Malware payload (Dridex)", "value": "4021e8f6d540c20c4e2f45aa05b586c56640011a97f9a5530ef29c69ee21e804", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941175, "uuid": "5c99dc97-b593-4f2f-b0eb-97390d116274", "comment": "Malware payload (Dridex)", "value": "973d84c843e2bced75bc5a1adfb9b4bd40b0f718", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941175, "uuid": "d77887c0-143c-4ec1-a4f6-f982ffc7b061", "comment": "Malware payload (Dridex)", "value": "6e7357a5ef99300e54cf8d3682bbe7af55e65d73f58b87ad6b924f25422efbf7dfca0b800685023780af2564e43fbf7c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941175, "uuid": "cf960a67-68b8-4f0a-b44b-fc685a10f153", "value": "98F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941175, "uuid": "ca38c174-9f9a-4ff8-812b-5fb5d4b1f055", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941175, "uuid": "20f50c1e-e3f5-4c14-a526-e9fe41c635eb", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618941175, "uuid": "352b74aa-ea56-4a0f-8c08-7523f4c69b70", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618941175, "uuid": "40ab0a6f-1a01-4354-9f60-1dc361d14ad6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941175, "uuid": "1810968d-b752-4a27-be30-6e4850a6d275", "value": "4021e8f6d540c20c4e2f45aa05b586c56640011a97f9a5530ef29c69ee21e804", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0de247-a232-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618962408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962408, "uuid": "d852b215-ea52-41d3-b982-ff54bd308257", "comment": "Malware payload", "value": "8d7ad47e2d5846a6dd79eb90c0628901", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962408, "uuid": "c32ec12e-671d-4a24-aeb2-30f36a94851a", "comment": "Malware payload", "value": "404e0143d59c23a955ec15471deb9110a64bcd617db12c679334cd82b5446456", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962408, "uuid": "99c68912-1b8a-4b6b-8c5e-d5ff469a06aa", "comment": "Malware payload", "value": "836e5a9b3505c9105730d5bf21c89b2f10fdacfc", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962408, "uuid": "41828bf4-f46e-4fe4-b233-888f8bb0bda1", "comment": "Malware payload", "value": "c5612080b465bf07a7b6050590de2efbf4ca75eea22e97fb0d1ffc88deaa6b0e6800223534a31e4f1eed653e949b9f8d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962408, "uuid": "a9673cfc-cd20-4e5a-8673-1e8d7aa1983e", "value": "9EF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962408, "uuid": "cafaba49-cd64-4d50-8966-2cb9da8f58e4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962408, "uuid": "4920b357-5de7-4296-bab1-d2d67370a7b7", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618962408, "uuid": "1f61e1ab-27fd-4f53-844e-c4b1b7404dc9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618962408, "uuid": "678b9ab0-cc46-46a3-b4e1-fd751875c532", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962408, "uuid": "4344b0ba-868f-466f-ae17-8d04ffdc5ba8", "value": "404e0143d59c23a955ec15471deb9110a64bcd617db12c679334cd82b5446456", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f3e50b-a20c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618945971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945971, "uuid": "ef2ae4b8-b147-4684-873f-9d59c2042e5b", "comment": "Malware payload (Dridex)", "value": "ad98476dd4a807443ae2c9c778834f76", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945971, "uuid": "04fccb0a-aeee-4d91-8bed-1b569ecede00", "comment": "Malware payload (Dridex)", "value": "4071e9f8046e9a7e3a88e1d5189cb971cc4d8844d6a313380a0a78ae61d3778f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945971, "uuid": "839eab96-1b16-49d2-8d8b-32c364734e5d", "comment": "Malware payload (Dridex)", "value": "835e925a065f62fcdf0f53db1a43151643bae9d4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945971, "uuid": "1d87e22c-cb15-4875-8800-5cd9ee3c6ab3", "comment": "Malware payload (Dridex)", "value": "ac265ab771730a0634b99998078e584ea6b8cff89c0e1dfbc5c62d14d802b82fcf4278781b021764c95a8814504a8851", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945971, "uuid": "654fc7a5-9e45-421b-af6d-5ac11688c9a0", "value": "1AF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945971, "uuid": "d10916c4-cfd3-4571-ba89-6e7d6f147478", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945971, "uuid": "0a5b10ac-0503-4d5c-bdf0-fe83e1fa3b02", "value": "3072:fwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:fwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618945971, "uuid": "60f661d5-1240-45ea-afba-9ad7608687c6", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618945971, "uuid": "cd88ca9a-0254-4678-9ad8-c8b58ae1173c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945971, "uuid": "fa7e19d0-d8c2-4ea2-aab7-924563d0463d", "value": "4071e9f8046e9a7e3a88e1d5189cb971cc4d8844d6a313380a0a78ae61d3778f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66b2e8d-a229-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618958667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958667, "uuid": "d6721d6c-fa88-445d-9158-42c2a6c67cef", "comment": "Malware payload (Dridex)", "value": "0322ba7f8e34cef0c25c1e37c5ce71af", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958667, "uuid": "cd2def45-138a-4fa1-a636-ac27487a8a60", "comment": "Malware payload (Dridex)", "value": "4075bbaacc629907be0167b801d03b7dec86ea7ff05b741e9cb8e172b9f46463", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958667, "uuid": "c6a94e14-eaa9-4637-9ea3-5f2fba2c05ef", "comment": "Malware payload (Dridex)", "value": "dcf6c99c65f12eee0111635b82f5e42c7c629c71", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958667, "uuid": "ff2e7b82-e392-49a6-8f14-2069583842a7", "comment": "Malware payload (Dridex)", "value": "a9bd77736971b31876707579d6d58698ec2d9e063dfb25e2edc58c9f1f9d662654628864fee415856c6bac13b1688566", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958667, "uuid": "ffe1d8c0-91d2-4e2d-807f-504b0cb92b04", "value": "E0F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958667, "uuid": "7f3acf0f-d8a3-4d0f-bece-a419935d5a65", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958667, "uuid": "267c299f-a0c9-4633-8dd9-e9e982283a59", "value": "3072:EwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:EwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618958667, "uuid": "ccaa36dd-b976-4f30-9d9a-860c3932f655", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618958667, "uuid": "c9bec4ac-8419-49e4-9100-71c81242cdc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958667, "uuid": "b7d377c5-0f47-4f6a-be63-9280319be7f7", "value": "4075bbaacc629907be0167b801d03b7dec86ea7ff05b741e9cb8e172b9f46463", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7e294a-a1a4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618901257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618901257, "uuid": "bc972b81-4112-4cc7-9bcd-63a691aa9410", "comment": "Malware payload (AgentTesla)", "value": "e712d5306be3bd666f0c7f8ee339fc01", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618901257, "uuid": "9b138716-9b84-48d6-830d-70df8a883b8b", "comment": "Malware payload (AgentTesla)", "value": "4093d9868af45612a60cba690351842d6ec33be2ea23ed0535e8c0bb0cce730e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618901257, "uuid": "c5746687-b225-41cc-b429-507d7eb53e13", "comment": "Malware payload (AgentTesla)", "value": "9c63189f761e58c2a5b0ef493f9744e7d8823f41", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618901257, "uuid": "232cc8ed-3136-47b9-91ce-e0e8e24076ea", "comment": "Malware payload (AgentTesla)", "value": "f514275ac7299bdc17f92f34ea349714feabd6dcff1ef4989fa57b830c2299a1272d9bf0941958755da25f6416827ceb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618901257, "uuid": "7e460d09-c0de-49f8-84c3-a84cfbfe4592", "value": "B945CF257F84DE08E2B93BFA88F49150A3F9EC118A17C20AEDF1359C8971BD7DD5124A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618901257, "uuid": "0e9e2b5b-5864-441f-b03f-2f18e1bd9700", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618901257, "uuid": "bc800be6-5a27-4a5b-ab94-b1e8540b5d35", "value": "24576:uPZROBOobXCRRRRRJOZdIxpp+l+QAIcnMGfydoWOb:uPZE3bXCRRRRR6dO+gQRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618901257, "uuid": "cc77b0f6-a632-41a2-9dce-712ba34df85d", "value": 1203200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618901257, "uuid": "7efec093-59f2-4ff7-9d6d-46c6f5a82894", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618901257, "uuid": "68a115d3-ec9d-4753-adf0-c1613e592ad0", "value": "SOA 4-20-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee48e156-a180-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618886069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618886069, "uuid": "b132488a-0f9f-4045-9bc4-75a181ee17e5", "comment": "Malware payload (Dridex)", "value": "96dfc3dd311e0489a44bbf2912208d89", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618886069, "uuid": "bf78cb84-2d18-4575-bf31-0b77b03f5bda", "comment": "Malware payload (Dridex)", "value": "40aea8d0c6b211a93a3fdd2cffa837d95945262a837b215c90f869672503e133", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618886069, "uuid": "b41002e1-52fa-44d2-883c-d59f0bf67440", "comment": "Malware payload (Dridex)", "value": "5d7797bd18adae859261bc359867778b97b5f930", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618886069, "uuid": "de89424e-d1da-4ee3-806e-8298b932dd6c", "comment": "Malware payload (Dridex)", "value": "ed1a325a24e80692dc2718058e1d1aa2f7a269dd598220c53813569a6b6c9f33362097d8334cf1b1bf56cf253e9b9588", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618886069, "uuid": "45dfd8e3-ba64-40be-bfa9-7e4775aa6a96", "value": "68F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618886069, "uuid": "e33a80ae-0b20-4c69-8eb2-f916f51d1558", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618886069, "uuid": "181ec3b1-4b57-495d-857d-caa0d7f4c5b5", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618886069, "uuid": "888d3a14-950f-423d-a216-92f82132ebe1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618886069, "uuid": "13194fed-132a-4950-a5c7-dcf90fda9d10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618886069, "uuid": "ca4378a1-0a09-441c-985c-f4dc7a98cdc1", "value": "40aea8d0c6b211a93a3fdd2cffa837d95945262a837b215c90f869672503e133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea400a6-a220-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618954520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954520, "uuid": "2b34fd1f-0865-4957-a15c-32c03de25c3b", "comment": "Malware payload (Dridex)", "value": "a559447558143ea735a76dcca7774a4e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954520, "uuid": "b1c1826a-af00-43f0-a10f-44d1e20c642b", "comment": "Malware payload (Dridex)", "value": "40d513d1b80fa02dbdce5d6bcae11bda44f69d02861da61d3c2a0303e6b42282", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954520, "uuid": "c0833e90-856d-453e-94bc-28472f2133f8", "comment": "Malware payload (Dridex)", "value": "4f32b057acfdc426b1fe2ba8867834fa9a1d0af5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954520, "uuid": "202935cc-dea7-4ee1-83f2-ee1f6e41309d", "comment": "Malware payload (Dridex)", "value": "4cd5332415d1bede271dd23f8b858682b433ea55b92cb842e57afdea5cbce807f684a14b9ebb525cefe4fbc8e85d8441", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954520, "uuid": "a746b02e-864e-4e02-a6f6-50404bc8b659", "value": "E4F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954520, "uuid": "dbff11e6-3784-4027-8949-fb18a4f2d768", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954520, "uuid": "f9d019fe-513b-4825-bb6f-532014d15e63", "value": "3072:6wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:6wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618954520, "uuid": "b7247a5d-e6a4-4297-adfc-ccaef179edd6", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618954520, "uuid": "7378cddc-3b0b-4855-9202-1b7f12ff25fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954520, "uuid": "308c6be8-bdb5-49b2-96a3-1a166540a231", "value": "40d513d1b80fa02dbdce5d6bcae11bda44f69d02861da61d3c2a0303e6b42282", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d8f9881-a1ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618933446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618933446, "uuid": "2ee89745-437b-4d83-a86b-af329ffd2046", "comment": "Malware payload (Dridex)", "value": "5f2f27502d7061708905dd29bb637c10", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618933446, "uuid": "9098da05-8292-4869-8345-9481f74b1421", "comment": "Malware payload (Dridex)", "value": "4126650f2907e47dba201eaf92b7421a8320e328808ef7ff9729f3d1ecdbdd04", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618933446, "uuid": "61353b1f-dd1d-4222-a536-57040ca0ad2f", "comment": "Malware payload (Dridex)", "value": "d751ea0276f1587c90afd71d55d021cd4adb210f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618933446, "uuid": "b2bf01ef-6541-4084-92f5-1281bdd2a9dd", "comment": "Malware payload (Dridex)", "value": "03acf9c426b77a7bc670091249a2e28bc9c87c1ad9ff003957ba8660bc8d01949a0713f3317c86bbd98aa2563048b38c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618933446, "uuid": "75be726a-e6bb-489a-a1d8-61c6ee92cbee", "value": "4BF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618933446, "uuid": "c9ad1558-07e0-42e5-81bd-a2727f29f191", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618933446, "uuid": "c02ee6b6-3f6e-4e84-84fa-6411c791c032", "value": "3072:mA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:m3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618933446, "uuid": "1df4441d-b90d-4c6b-8f30-baf7d09d0c21", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618933446, "uuid": "94cf85d0-058c-4c5e-933f-f0c942985365", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618933446, "uuid": "8ce4e81c-10ec-4bb9-94fa-34ba97b06eb4", "value": "4126650f2907e47dba201eaf92b7421a8320e328808ef7ff9729f3d1ecdbdd04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d396791-a1e6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618929500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929500, "uuid": "3cd6f386-d223-4c69-927f-c6ec1cbcffa8", "comment": "Malware payload (Formbook)", "value": "c27bd99ca5f928a3bec7a716bd27d289", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929500, "uuid": "3df32f9f-c956-44a2-94d3-513a74c6afe2", "comment": "Malware payload (Formbook)", "value": "414d26c286eeeda12cc3705aa3ed2ae06e901dc09795434e6abe4389f31c1e8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929500, "uuid": "f44b5deb-e483-4411-9a4a-8f06794842ef", "comment": "Malware payload (Formbook)", "value": "f6ac29d30ec60cd1429bc2e31c85c8eda0bc871e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929500, "uuid": "9dbe5295-db16-4027-af92-1f92028fc6cf", "comment": "Malware payload (Formbook)", "value": "5b1b921590c8721da126072984a3fe9a46729a7668ce9ba0f11701b75bf1f1840a40ef03689101a090dfd30e4cf6a278", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929500, "uuid": "185b3e04-2a67-4dd3-92c5-7b0f517443e2", "value": "07D4022133A9D754D87F8BB41851550027F67626EB11EF0D7DBC11AC4FABA838722BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929500, "uuid": "4292001d-cf21-48ce-814d-798bd2e0db89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929500, "uuid": "ee284a69-abbc-4eb6-bc6a-37dbf8656a26", "value": "12288:I2rng766A4Fn/pgceBpKcJ1k8WwyVu1zRRRRRy:Tg7nA6/wBEcJ1dWwyoRRRRRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618929500, "uuid": "34f16e6b-80ec-4319-9194-3032cca6e7ad", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618929500, "uuid": "f799ac86-fbab-4762-b76a-448eea492c11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929500, "uuid": "e7ca1886-e051-42fe-a3ed-777c050ba1bf", "value": "RFQ_R4100131210.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7456567e-a1e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618930102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618930102, "uuid": "4fc37d48-c5cf-4be8-ba05-a46b80915423", "comment": "Malware payload (Dridex)", "value": "53916f391814e5f5456ef3f0082f03c7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618930102, "uuid": "0af86696-cfef-4d16-8b6f-efd09ef6c101", "comment": "Malware payload (Dridex)", "value": "41793676091012cf6fa3db6736bd1210c489355a6d4441b20a56cc8734affb86", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618930102, "uuid": "04eba4a5-4c4a-41bd-a795-5b89413a3e50", "comment": "Malware payload (Dridex)", "value": "cc18cf1cd0ed2dc8fa0c8cf764c65f6c901a1ff3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618930102, "uuid": "007298b3-17cf-4022-81c5-7f805e764b44", "comment": "Malware payload (Dridex)", "value": "a524ae780c5fe85a54bdcaaa63eccddc48df8170eb9ad8acb310a5da216387071849100dc85e7c4d8a0654134388a1c0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618930102, "uuid": "70f5ea9b-be64-48a7-9345-681ceac7c941", "value": "6BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618930102, "uuid": "d9f1d20c-f991-4aea-b4ff-5bbd79510f01", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618930102, "uuid": "1681b4b3-08c0-4fc2-a4e1-873cade429e3", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618930102, "uuid": "83252c41-6ee6-45d9-af97-6527c8d4e723", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618930102, "uuid": "663999d0-f845-48c1-9fb0-f8fd6b1709e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618930102, "uuid": "b7b9154f-6fdf-405c-9ae0-69f2410e4ca7", "value": "41793676091012cf6fa3db6736bd1210c489355a6d4441b20a56cc8734affb86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e796b422-a1e4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618929007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929007, "uuid": "c1a89887-8654-40f1-a04a-368edf060694", "comment": "Malware payload (Dridex)", "value": "2ea3627c9a9edd9d01a8b49914efdc49", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929007, "uuid": "ab09ea98-4671-492e-b802-d0645f95410a", "comment": "Malware payload (Dridex)", "value": "4199af4f07e8c837c7b3a855bc5e9602ac17f0bd126684be804bd6a6f98d06e1", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929007, "uuid": "ce7ef134-0671-4dde-9137-1202e579d988", "comment": "Malware payload (Dridex)", "value": "d14ef7f259ad09354acc1e9ddf56ea8902e84226", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929007, "uuid": "ec6d0539-8e93-48ac-95fb-38c7b1091fa7", "comment": "Malware payload (Dridex)", "value": "6a52bb263e98b2c6ec3dd6654d836bc845cbdb9c985f9c5120870a07b0ea5de91a81a23d14be33c95649eb309a08d4f8", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929007, "uuid": "45f25929-6ac0-413a-8740-2c1339d13539", "value": "DFF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929007, "uuid": "5b65cd16-8ec0-4310-b950-2aa11cad8d0b", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929007, "uuid": "c8d5ff46-49f2-4e66-892a-1d9936605054", "value": "3072:flpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:flo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618929007, "uuid": "401c7b29-3ab8-4c39-84d9-2f6d61aaca4d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618929007, "uuid": "72f72726-30e3-490f-b00c-aea806270332", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929007, "uuid": "74ae62da-9eba-43d7-8bf9-e41adb680fdc", "value": "4199af4f07e8c837c7b3a855bc5e9602ac17f0bd126684be804bd6a6f98d06e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810971aa-a1cc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618918527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918527, "uuid": "2fff5dbd-6b48-412d-8325-0180a3a1af53", "comment": "Malware payload (Dridex)", "value": "ca77fe34e73114e5744fdfbbcdbc9c3d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918527, "uuid": "89308819-0a92-4b50-9d2e-310b829633c2", "comment": "Malware payload (Dridex)", "value": "41ad4febce1d9a6c21e88212425e220aadb098f56ae0756fb309f901b3decb6a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918527, "uuid": "58ed65df-a417-4ef4-84af-8c6454e27959", "comment": "Malware payload (Dridex)", "value": "4f9c117d6ab8308347c408062c5a34695ff1ddac", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918527, "uuid": "68871c7f-7388-4744-a478-0225cf973a3c", "comment": "Malware payload (Dridex)", "value": "96ee82a6b7051ac8103aac0ecc44118079350cab14c2d8f8dbd4b513d71ddfe5ac6b0009bfe74f2732fc830fe591a2cf", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918527, "uuid": "743b3d3f-aac4-4691-9cec-989232022490", "value": "15F3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918527, "uuid": "964f6ca7-51d1-4941-beb8-f279afd97624", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918527, "uuid": "4fd4afee-eb83-4798-973a-9410b0686878", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618918527, "uuid": "8e31efcd-2dde-45f2-8742-a43aaddfbbe3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618918527, "uuid": "47e6033f-4838-433a-a5da-fea31088abac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918527, "uuid": "206de180-e29f-47f7-906e-591272522c94", "value": "41ad4febce1d9a6c21e88212425e220aadb098f56ae0756fb309f901b3decb6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daea8a44-a214-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618949602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949602, "uuid": "215ab68c-65ab-4f16-a922-f2a91bb30d05", "comment": "Malware payload (Dridex)", "value": "cabd73bca2ed90e1ace8100fe80ec55a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949602, "uuid": "5c55e071-1da8-446a-9a23-529a1bdc12ed", "comment": "Malware payload (Dridex)", "value": "41d5fadfdd7aef0dc21620504819793040e9715832824f87ff8c0867d6d07238", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949602, "uuid": "995d89cb-535c-44ea-aa9f-6fed75bbfcf4", "comment": "Malware payload (Dridex)", "value": "f03fd78b00e1615b6ec278a2b56fa7e2fcef08cd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949602, "uuid": "0719d356-d1f9-489a-8602-620b88fbebd7", "comment": "Malware payload (Dridex)", "value": "29795b7c8e3a6c280b3591e0eac51d655dcaf5b3d8825cf4d0b9e26010f0d7a2251315e20b75088a7bb85f38eeeef266", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949602, "uuid": "6c61b27f-f5dd-4f56-a9a5-5dc0f4f97d4f", "value": "B2F3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949602, "uuid": "b383afa2-a287-4db3-b456-9f5aad58ed1e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949602, "uuid": "30247444-5906-4b9d-8061-3adb15063cd5", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618949602, "uuid": "139223a6-c9fd-45c8-8fec-56174763c372", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618949602, "uuid": "5d56a98d-d8ee-46f0-b31b-33027d0f3575", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949602, "uuid": "69b84f08-2774-466b-ad7f-70370c7b0da0", "value": "41d5fadfdd7aef0dc21620504819793040e9715832824f87ff8c0867d6d07238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249066de-a228-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618957886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957886, "uuid": "8d3799de-7396-4d84-bf6b-48b7f88db48f", "comment": "Malware payload", "value": "c5c3fbab840b6ad43a222ac4763fc6f2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957886, "uuid": "4d5ecebb-6567-4702-91c3-621163675a36", "comment": "Malware payload", "value": "4277a7f26977dafc0e8fcdd78f4ff0bfe0093136363a651e7092270f93245e7d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957886, "uuid": "e396d588-d2b4-4918-ad1b-8ce21aed1cf9", "comment": "Malware payload", "value": "d2cfed836a2f5ab524137d3db63f6d82d26c6ae6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957886, "uuid": "731a25b2-1402-4b13-a582-731bbd643831", "comment": "Malware payload", "value": "35daae4549d8554a9ff3a23981295513960027e93c67c3b65d71765969777c6005a57898f1767807ee22b4f3f18f0db4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957886, "uuid": "75dd2699-4045-436d-9164-4eaf6aac8b87", "value": "6AF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957886, "uuid": "a96f26f8-a4d4-4900-9d9f-0d7a44ba7b62", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957886, "uuid": "1dfa6951-6695-49d2-8264-08e50aa9342d", "value": "3072:QwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:QwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618957886, "uuid": "bacaf7e1-e5be-4097-9566-034e2e169884", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618957886, "uuid": "6fcf5e4a-1385-4f50-843a-2871278a399e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957886, "uuid": "8717d046-2294-426f-b8cc-54e20809dc44", "value": "4277a7f26977dafc0e8fcdd78f4ff0bfe0093136363a651e7092270f93245e7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720ae011-a1a4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618901322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618901322, "uuid": "2110e430-4dfb-44b3-80bb-41ef58ddb8ea", "comment": "Malware payload (Dridex)", "value": "68c7d9114ed545ad4bbeb7aca91eebac", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618901322, "uuid": "9ac472d1-4f93-42ee-b7a1-aa79f2aaff11", "comment": "Malware payload (Dridex)", "value": "427a2aa54349f7466dac1b9efb3b0b9f0e9981458e4514647fb05d7123a512b2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618901322, "uuid": "95705a70-3e16-4c47-993c-0a8d019612d7", "comment": "Malware payload (Dridex)", "value": "7d6af8e22f7b0974c79d42d5ebfd13afdaf69005", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618901322, "uuid": "272428dc-41f0-4d37-8c78-2a540f299221", "comment": "Malware payload (Dridex)", "value": "e3b5b5b1130b49e75da773b5859eb56c9b0683e1f63791be251eaa4ac0eaf7321d0aefc1583a2835d83892c12439c834", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618901322, "uuid": "e0362a6a-89a6-4a6b-a980-d42e05185347", "value": "5CF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618901322, "uuid": "8ca57ab9-2752-43e2-8027-a709d91b76c9", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618901322, "uuid": "ca0e261e-e3fa-43a8-8d54-54ce2e73aaea", "value": "3072:BA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:B3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618901322, "uuid": "f8cb8c6f-d72b-41ce-98a3-3b735ff8baa1", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618901322, "uuid": "e674ac48-4a18-4927-b16c-bb67f3af4d61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618901322, "uuid": "e136f14b-7327-4c45-a9b7-c21d90c55384", "value": "427a2aa54349f7466dac1b9efb3b0b9f0e9981458e4514647fb05d7123a512b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e752be1d-a18e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618892070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618892070, "uuid": "57e3a923-8d1e-424e-8f58-ec8ba5312b79", "comment": "Malware payload (Dridex)", "value": "d277d3113ab02c972299715317a83b7f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618892070, "uuid": "18d2d4ad-a5fd-4c73-b56b-3bf5476a7c04", "comment": "Malware payload (Dridex)", "value": "4295f74feae0c55ccf844104f4688ebcdaea774b47ca095ff0ecd7bc5242ebb9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618892070, "uuid": "229c9876-e48a-4498-abcd-6bfd05911057", "comment": "Malware payload (Dridex)", "value": "cccd4f18b5fa9d3e63eba714bd2b7e4a0b62ab19", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618892070, "uuid": "62fe7bfb-c3c1-447a-bbfd-27b0965c7cfe", "comment": "Malware payload (Dridex)", "value": "e3ec247d52d9ba47c570b80cc66c645b488b381e60cfe420d410e2c0744e9be91941740a411bcb7b70b18d35c6fe40f3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618892070, "uuid": "d0285436-fa2a-4501-8479-eeaa0641f94d", "value": "35F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618892070, "uuid": "da5fbca3-8d6a-4739-81b2-cbf79a30b5ef", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618892070, "uuid": "9edb7cd3-ce26-4ae4-94e4-1c11ef3a4bbc", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618892070, "uuid": "2e8d84e8-8d04-4ba0-8fb9-06227c35ea59", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618892070, "uuid": "3a86aaad-75d6-4ae9-9c6c-a125e01c0670", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618892070, "uuid": "a77eb16b-542a-4dec-9150-eeec8083191f", "value": "4295f74feae0c55ccf844104f4688ebcdaea774b47ca095ff0ecd7bc5242ebb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c59963c-a18b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618890414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618890414, "uuid": "8d26d360-659a-4971-8af6-db00ed90b8b9", "comment": "Malware payload (Dridex)", "value": "ece86e56962d93c51ab1c5b054768770", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618890414, "uuid": "3be918e8-cf24-442e-a0cc-5217ae4dd1db", "comment": "Malware payload (Dridex)", "value": "42a6e4f7132367b5c9885d448998fb13bdbf4fe119cb6bbc57a4214c8f071a65", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618890414, "uuid": "85deb3e9-5d5c-463e-86e0-481af5778139", "comment": "Malware payload (Dridex)", "value": "648a9e77baf6c0ce010fd34dd280b4db83604ec8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618890414, "uuid": "5bd1c684-8256-44e1-9989-868756601d0d", "comment": "Malware payload (Dridex)", "value": "d506121f4f53be5b74ce5aad50a58e15abb42768b21f181b835e6a17a437e2d5fc235916115df58ffcccf9365f78ec52", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618890414, "uuid": "fe2ed1de-f51c-4fab-85e5-b138c406fe5e", "value": "F9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618890414, "uuid": "4e407e83-269f-44e2-9fb7-40a9f6d8a256", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618890414, "uuid": "97af01bc-d83a-48cd-b317-0a868c8ad9b9", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618890414, "uuid": "debf07a8-712d-45e6-90bd-53ecef0e0c63", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618890414, "uuid": "fdfc83ba-bb03-4ef9-b212-7afd894edc9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618890414, "uuid": "cd0b715f-828d-444c-80a6-212a8bba9737", "value": "42a6e4f7132367b5c9885d448998fb13bdbf4fe119cb6bbc57a4214c8f071a65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a073c2b0-a204-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618942632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942632, "uuid": "7ae68aeb-2868-4ec1-afa0-78c459aa2938", "comment": "Malware payload (Dridex)", "value": "cf4d9d63e1c3e7d59858c7f87e1f371d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942632, "uuid": "a4068b04-a13e-4b79-bfb7-4569993ff9bd", "comment": "Malware payload (Dridex)", "value": "42e3878a49ebfc65582767dd7630452455c4b2909b425d2189f34f323090a63e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942632, "uuid": "d7ccffe6-f8bb-4b34-bc21-f25107aa56f4", "comment": "Malware payload (Dridex)", "value": "fb72468c43c9d85fe645d4ce525beb71b30829c8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942632, "uuid": "6e984dde-8b6e-4aec-aef6-51fc8116aced", "comment": "Malware payload (Dridex)", "value": "5b91ff1e8f783e11f503ef08dfcab7262b67878cf805d3f689e5ec12dfe34381f93dbe276d7dcba47f754938a21b64a3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942632, "uuid": "e5fa721f-5d52-4259-b77e-51751b97f4b1", "value": "C8F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942632, "uuid": "72fc28b3-0ec8-4187-b420-411a68058660", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942632, "uuid": "c176fcfd-6652-472e-ae07-9855735b4a34", "value": "3072:9wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:9wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618942632, "uuid": "69c08225-eb80-421a-9566-a6ae3d7b61ca", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618942632, "uuid": "cd18b3df-96db-47dd-985f-7314117685ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942632, "uuid": "9b3ccabd-9618-4f95-8ab5-d0839570334d", "value": "42e3878a49ebfc65582767dd7630452455c4b2909b425d2189f34f323090a63e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e254fc5-a220-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618954466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954466, "uuid": "108e9203-9a11-4fbe-818d-47a90b1e4248", "comment": "Malware payload (Dridex)", "value": "f512dfc4dfe685e7410b984e64f5ce55", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954466, "uuid": "46d793ac-97be-43e8-8091-b199e379a092", "comment": "Malware payload (Dridex)", "value": "4355bc7eb36328b54f5441f509fa3babecf0d7f80252338e8362c555824ff78b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954466, "uuid": "5b7ffe41-b980-4362-95c6-8c204797dd3d", "comment": "Malware payload (Dridex)", "value": "670484998cc2fba3d8f2e3cb99d986415c949393", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954466, "uuid": "beba5506-639f-4ccf-956d-bfdb3192a7da", "comment": "Malware payload (Dridex)", "value": "3d3dab329cb9140cd5c836ac29249a59660b7548b4891cf2cc4ce053bb5e5a8096a08f4cf3d74e5911abca4167bca1a3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954466, "uuid": "7084cf6e-6c86-4b1d-8cb8-8eb81f9e267c", "value": "8FF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954466, "uuid": "d4b104f3-436e-4f7a-b2cd-3b85d3985c73", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954466, "uuid": "042f4d8d-8b4e-45a1-bfbf-39ead0b12a66", "value": "3072:EwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:EwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618954466, "uuid": "a7153927-93cc-40d9-adc0-76b0bf48bf91", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618954466, "uuid": "a709a0c8-5143-4f9d-9f96-473814f9fef0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954466, "uuid": "8ce1694d-2ca1-4437-a273-44eb581f353d", "value": "4355bc7eb36328b54f5441f509fa3babecf0d7f80252338e8362c555824ff78b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00474802-a233-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618962549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962549, "uuid": "a7e55dd6-6f0e-4b41-92d8-b029ca1fcc89", "comment": "Malware payload", "value": "3aff14222ddac0927f88676f7e132813", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962549, "uuid": "7bce52ca-d602-44f7-ae88-f245a7f81526", "comment": "Malware payload", "value": "4356775fa21888c44308ff559a3d3958ce968667cbc722419a6fab458dbb79d3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962549, "uuid": "5dee20f8-ee77-45b5-a682-3874c8aefcf2", "comment": "Malware payload", "value": "d251d173cb8ba4128bdb8d27b69dbdb19974eb52", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962549, "uuid": "4a6950c6-f3ec-4de8-a346-a5ac92e56d95", "comment": "Malware payload", "value": "2421e4bf08a3002916a292fe356b9584e39d78e5122fee25647e2c295b8d21a47c032f48173dd926c6472d8fb46374fe", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962549, "uuid": "2e897bde-cb70-4863-8e75-483e0af75e06", "value": "C2F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962549, "uuid": "554a0017-a9d2-41f9-b51a-76d05f2f54f6", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962549, "uuid": "374c4997-4de9-4ab7-ab0b-055acd2d7a48", "value": "3072:ywZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:ywZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618962549, "uuid": "b3eb8ec8-e5cb-4c1a-b9b7-6fe311f8e63f", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618962549, "uuid": "85df7507-c4bb-4e8c-9a6a-84d46c4003e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962549, "uuid": "5a32d9a2-9aa8-4cd3-85e5-c99d5ff40af7", "value": "4356775fa21888c44308ff559a3d3958ce968667cbc722419a6fab458dbb79d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14493379-a1d0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618920063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920063, "uuid": "254dafb3-e765-46ee-afaa-808d615a4638", "comment": "Malware payload (Dridex)", "value": "fd9b890b8810a38b0c25a5d925124013", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920063, "uuid": "0ff44299-c009-478d-a749-2323f6557a71", "comment": "Malware payload (Dridex)", "value": "435ed365ac07968455630626bc83d7149c55653d864d84765e78945c6358bc1d", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920063, "uuid": "b4a26ab5-6510-4f0d-9bd3-5b232be69e30", "comment": "Malware payload (Dridex)", "value": "03538654d1b0adc8b5bd0b156a13f38724ba91a0", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920063, "uuid": "77409365-b72c-414c-b118-ef1531327d8f", "comment": "Malware payload (Dridex)", "value": "d582a7805ca63aaee7bf28ef23210ad480ba7b37055d96cf9a1a4c83d7e86dc3bccc9815d3bc43203cc39ed1c8f91962", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920063, "uuid": "bc37226e-2c29-4040-91d3-10d4a4edfbbe", "value": "13F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920063, "uuid": "1655058f-2a49-4523-83b9-4a0b845f0d59", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920063, "uuid": "5d0f9884-90c5-439c-924b-876d6e197811", "value": "3072:8WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:842IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618920063, "uuid": "80c8aa34-07fb-4305-b799-3fa0665a1da9", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618920063, "uuid": "1d791e3c-9e23-492f-a936-e549ff307a83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920063, "uuid": "cce0bed2-c1b2-43a2-a3ae-2bfa19f92460", "value": "435ed365ac07968455630626bc83d7149c55653d864d84765e78945c6358bc1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74bf744-a211-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948253, "uuid": "f767661a-4fc7-470e-bdde-87be10f99d88", "comment": "Malware payload (Dridex)", "value": "d3342e7356b71964b1b6e22cdec72f25", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948253, "uuid": "ed915e22-8e6d-4587-ab23-3f251d320a87", "comment": "Malware payload (Dridex)", "value": "4370b6640737680853197be6d66ca26dfde54cdabb1e488b2fdb9e092855b92c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948253, "uuid": "e85d90ed-b198-4293-beff-711038bde6e7", "comment": "Malware payload (Dridex)", "value": "d586a18de919126df040082015ddb6ce013f7b77", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948253, "uuid": "e3295bf1-a655-471d-b05e-ce7d1adfc042", "comment": "Malware payload (Dridex)", "value": "41f93f67d42ea36aeb55ba1b7ebaad6bf0e3e1d7a3adb59b8bc16f79023c7f45e4affc400dcffe55e4bfb4600a5a2ab4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948253, "uuid": "bbde9d46-2de0-4199-9631-efceef9b5d4b", "value": "ADF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948253, "uuid": "739a4d12-f10f-4810-a81d-20993f6e44ed", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948253, "uuid": "d3f252b4-87c8-4e1f-ae0f-1de2bd6898f1", "value": "3072:hwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:hwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948253, "uuid": "d63e2705-4525-4a00-9e39-8c714213c515", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948253, "uuid": "684de9ff-3e9d-4afc-bc55-895a40c84d22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948253, "uuid": "fc4f90bc-48bd-43e6-9f13-5cb8172907a4", "value": "4370b6640737680853197be6d66ca26dfde54cdabb1e488b2fdb9e092855b92c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c067c215-a205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618943115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943115, "uuid": "cb919cec-3abc-4df0-a71e-7e27fedbeb12", "comment": "Malware payload (Dridex)", "value": "d1a597301564d4d748cfc410c1910535", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943115, "uuid": "1dad68f4-a8e8-4f1f-bb4f-d5b1a9f36497", "comment": "Malware payload (Dridex)", "value": "437a3690554183259b69dd3ff39f4371cd4a917556d8bec54a54c2059722ee34", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943115, "uuid": "a93640f2-ac5f-4135-ad82-7453969fd2be", "comment": "Malware payload (Dridex)", "value": "252688c26bb0becfcaa9d5f53844670a9ebefd35", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943115, "uuid": "bc12ae0e-6e9c-4d55-9d12-02512852c67a", "comment": "Malware payload (Dridex)", "value": "94868440b62b0128f912b8dd41ff838c864b3d8b4d53e9899e487b275a1d4f70830f3fb9c2cd68ca27dff6c7f8e2f3c0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943115, "uuid": "d4ff77e1-4eee-4f3e-adb3-88b7eb29b1d5", "value": "3DF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943115, "uuid": "99f5245f-6d15-4c22-936f-0e4e26359238", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943115, "uuid": "0020fd75-692a-456f-8d51-d7bb7048b41d", "value": "3072:nwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:nwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618943115, "uuid": "ad5a4655-509b-4d53-ae08-91d9fe0e3afb", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618943115, "uuid": "12cd4a31-b325-4744-a202-25cc22cef1a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943115, "uuid": "1ada7a41-0924-4e45-b22a-dced9e62d526", "value": "437a3690554183259b69dd3ff39f4371cd4a917556d8bec54a54c2059722ee34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e081144a-a223-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618956053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956053, "uuid": "3211aa14-56b9-4fdb-9098-2210cd9b3b0f", "comment": "Malware payload", "value": "eb0cf218c7acb9964596439dab8b7c91", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956053, "uuid": "e1774e9c-efec-477d-a1ec-bc9a6fdd3ed2", "comment": "Malware payload", "value": "43a47f8f6ed44a22befe4ace1952eeba00e2507997b06c477516876967ed4233", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956053, "uuid": "fe3f0775-cbf4-4e8f-9a53-1cc59b6445a2", "comment": "Malware payload", "value": "bb89e3432ee1ab2a39367bf2213e84519970b771", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956053, "uuid": "e36415b3-9baa-4a0c-b341-9885add21d90", "comment": "Malware payload", "value": "f45dec44a07fe32788fc98e449886d2cf65c1f959a5ca474ee1afddb0227182f0085f12514badf52f1f8af9a1442fcf9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956053, "uuid": "6ff60b0c-e95a-4f4a-8baa-74a43477074c", "value": "0FF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956053, "uuid": "fd479245-b79d-4e12-b14a-724109dfd212", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956053, "uuid": "b0a5aeb0-b652-4e49-a7b7-8064ea0fec77", "value": "3072:cwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:cwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618956053, "uuid": "c9de5679-856d-4db6-8790-d08842c3bde1", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618956053, "uuid": "e2ebbcb2-ab8b-450f-bbd2-99f11a6a7b67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956053, "uuid": "8f69f920-5404-4a61-8e2a-10316258fb15", "value": "43a47f8f6ed44a22befe4ace1952eeba00e2507997b06c477516876967ed4233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e776cee-a1ff-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618940239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940239, "uuid": "9212dddf-7988-40ca-a25a-df228cbe7d0d", "comment": "Malware payload (Dridex)", "value": "c842a0155e68c9128d27aacdb2dfeacf", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940239, "uuid": "88855c09-9e23-45b2-9eec-c842ef044d3d", "comment": "Malware payload (Dridex)", "value": "43ba7c3d7505f3b10c1f46058cf25a1e0efea63e2e03772d0e08d6efc104cb2f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940239, "uuid": "03e55f21-c5d6-4000-a0ec-e17fae60642c", "comment": "Malware payload (Dridex)", "value": "03f6799297939bddd228786354a49bdf56aef743", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940239, "uuid": "bc378e52-4af0-4f4b-9624-27730d02d972", "comment": "Malware payload (Dridex)", "value": "f4cedecf513fcae584daff325c049851ab47af8e3f30a9898c91231fb2e4aef467fae2600169a2bf8b7ec2195f557fb8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940239, "uuid": "20bb8946-832e-4490-861e-669a61381776", "value": "F0F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940239, "uuid": "57ded4b2-8304-4e8f-889d-4513e60d6a51", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940239, "uuid": "2789972e-f167-408c-86a9-ad951b332b2e", "value": "3072:4wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:4wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618940239, "uuid": "fde92dfb-b9b3-46c5-b84c-bd4a2e6028ae", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618940239, "uuid": "8decba13-0cbd-4c5b-ac4e-4058ac4fa548", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940239, "uuid": "84313978-29a6-4402-921e-9d5dbd635524", "value": "43ba7c3d7505f3b10c1f46058cf25a1e0efea63e2e03772d0e08d6efc104cb2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e05f3a-a1fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618939899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939899, "uuid": "502643f5-0cd0-4448-90bc-b96209959910", "comment": "Malware payload (Dridex)", "value": "a9e9911f0507c06b7e6df2f2e6858a7c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939899, "uuid": "2671b974-1d42-4809-9d16-7351e9f56c6a", "comment": "Malware payload (Dridex)", "value": "43c7f06ab05b8bbcb0aecbde276607f6d7864e22d2498d8a17433c1a93dd1069", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939899, "uuid": "e829ea70-6d13-4bae-a685-6bfe62036289", "comment": "Malware payload (Dridex)", "value": "90f1617bc2db727c90e888a5d62d4ab75b2e22a9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939899, "uuid": "3cc4e629-a2ea-4407-82ab-129533f93138", "comment": "Malware payload (Dridex)", "value": "b9b66a56a3ed42f11653d8a65ce8c33f2aeeeafb6bfedbd328017ab83e5761fbdee25fa891b138310c2ee87c0efefbd7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939899, "uuid": "8ddce181-c15b-4d99-8a3e-c0a83e159d4d", "value": "77F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939899, "uuid": "dce02002-002a-4255-9ee3-79e33a1361aa", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939899, "uuid": "90e90c8b-c88b-4527-9924-7661f020ddde", "value": "3072:fwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:fwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618939899, "uuid": "d52c3d4a-c458-4129-9ade-b53eb84b4122", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618939899, "uuid": "137f14b5-8b36-4862-8a09-1f9017ba86aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939899, "uuid": "75afe683-f4a4-4bff-9bb5-32f0f471ee15", "value": "43c7f06ab05b8bbcb0aecbde276607f6d7864e22d2498d8a17433c1a93dd1069", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3965dfbb-a1c9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618917118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618917118, "uuid": "4f6cb5f6-41a4-4af7-b488-0b103cb5d13f", "comment": "Malware payload (Dridex)", "value": "860987db1870b6422a0da56cb8c9b8ec", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618917118, "uuid": "da88fa08-a06d-42ef-8bbc-b2cb825c0e8f", "comment": "Malware payload (Dridex)", "value": "43f0c9db66769df4eb61e5e67bb594c5bad924812bc5aede4deb3c2dbd67bbb0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618917118, "uuid": "fb34a57c-3bd3-4b24-bd36-5f06ad30723e", "comment": "Malware payload (Dridex)", "value": "a91a81bba9e3ebecb4460c400324c89454bb842a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618917118, "uuid": "2ae5332f-148d-4b91-9527-ce31aaaf8c36", "comment": "Malware payload (Dridex)", "value": "b27e0678655a3ada9a818395cb9875b3f16d17490f5a5ab069dccbb486efa6fbf3fd451ed20391fddb61e1b66f21d1e9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618917118, "uuid": "07749356-1ad2-427b-a36e-819aa71e8e67", "value": "4FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618917118, "uuid": "c7563abf-d7c8-46e4-8977-84b1e915f4f2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618917118, "uuid": "ffdfe1ba-dcaa-4dfb-9f82-88ca34af15e6", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618917118, "uuid": "7f910a1b-b83f-44ef-95ff-071c32e0adb8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618917118, "uuid": "d83cf5bb-9b5b-4b0c-9249-179c3623d2f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618917118, "uuid": "3af37b5b-e2c2-4ca5-bac2-1eb9664a5669", "value": "43f0c9db66769df4eb61e5e67bb594c5bad924812bc5aede4deb3c2dbd67bbb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94dc5b62-a1c7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618916413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916413, "uuid": "660d4cf8-aacf-47b5-95ff-a4e1980e0d5e", "comment": "Malware payload (Dridex)", "value": "21aa4a355bd097fc58a6d1f1919137e3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916413, "uuid": "958fcf22-39e5-416d-8aa7-3df969efeecb", "comment": "Malware payload (Dridex)", "value": "44006306e3b6b6e9253fa7455eb2efae9c08920f5c0f1bf94bc470c43f477d00", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916413, "uuid": "e396bf95-65d0-463b-b1b4-c7d2d489c657", "comment": "Malware payload (Dridex)", "value": "1d9194ec827e6ad90d760c1772a7270859a1fd13", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916413, "uuid": "a14ab33c-ce49-4d7f-baa9-82840cacaac7", "comment": "Malware payload (Dridex)", "value": "04cc084fe406a41778d9d53f599a843dd75cdf3029b84ccdc30d893b72571b8e4c778b3f4951e2e2904edf9c1c30a2c0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916413, "uuid": "159f7b95-90df-49d2-9892-0576bfd64122", "value": "7AF3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916413, "uuid": "cc408308-e5e5-45bb-9323-f883d46ad1e7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916413, "uuid": "fece4dc7-e7d1-43bb-a40e-b7e9dd05632b", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618916413, "uuid": "8ee03a2b-109a-490a-8ec7-2dd9a8e37f68", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618916413, "uuid": "dd51ac56-0e37-45f6-8acb-520adb765bfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916413, "uuid": "03884406-6738-4e8e-9186-e3857786c4d6", "value": "44006306e3b6b6e9253fa7455eb2efae9c08920f5c0f1bf94bc470c43f477d00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86bf6d1-a1c5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618915613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618915613, "uuid": "3e27e6b5-80df-4a74-b984-e0a1b5e6865a", "comment": "Malware payload (Dridex)", "value": "144b3ecc498b1339ff7d858cd443b422", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618915613, "uuid": "a4faeb0a-ca92-49f7-81ec-7179046a8e49", "comment": "Malware payload (Dridex)", "value": "442226897e32f6b0ffc0ffeb1d0d2dcc7819b58a03fe2540af1af6e9bc04c3e1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618915613, "uuid": "09527753-2722-4df5-b26a-389050d37774", "comment": "Malware payload (Dridex)", "value": "9e1138fdd01bfe43f98dec3cd121b26502da0ae7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618915613, "uuid": "4842bc1f-5045-492e-b236-29e13a42d2fc", "comment": "Malware payload (Dridex)", "value": "51add0b017fcd3fc60b413572fb145f5e18d2cef3c7544a2668b7f98ce1ae50d5eb2ac7cccd001a34f51634aa9c14910", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618915613, "uuid": "0b789a23-7f13-404d-8172-ac0be9714949", "value": "15F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618915613, "uuid": "edcddbf6-c144-41e4-9290-76080f9d62ed", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618915613, "uuid": "b4bd634b-2eb2-44d8-9b3f-0808802fa95e", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618915613, "uuid": "afe9ea51-1ce2-4d34-b0e6-e0e01bf541f3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618915613, "uuid": "b2e1953c-3bc6-4016-be67-ebea576180dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618915613, "uuid": "fcc71bb8-f938-457b-bb29-487ef42a3508", "value": "442226897e32f6b0ffc0ffeb1d0d2dcc7819b58a03fe2540af1af6e9bc04c3e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca7a5d3-a1bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1618911030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618911030, "uuid": "9e16fc7f-2f05-4575-82f2-b64a41c97868", "comment": "Malware payload (njrat)", "value": "594107e4fa30c20d998acd9d408225cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618911030, "uuid": "c747f4f5-ffed-4f03-890b-3fbf946a1f32", "comment": "Malware payload (njrat)", "value": "4427984a82d018c73e0e23a7ac52eb4816ffc56f07406d41a01dbe4d795c22a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618911030, "uuid": "0c9fe777-1e9d-4251-ae3f-40a1d46f03a8", "comment": "Malware payload (njrat)", "value": "c7ece39ee72599fc020b0eaea8236942e9e30de2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618911030, "uuid": "3cae0bab-1d64-4984-997c-08071059f5c6", "comment": "Malware payload (njrat)", "value": "1d0ed27aab721ba176460adae094899a11f82e2f9794ad242264142ea45a5a79c1bb0a3668bddc5aecb031887413de3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618911030, "uuid": "538190b4-a7f3-44c8-9548-0c8732826e4f", "value": "3FB4E01232A9C648E8BE4BB40861524117F7BE5AEB31DB1D7D5C305C5FBB6838312BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618911030, "uuid": "83e2e2ae-8944-4377-a3d5-65870cfbf896", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618911030, "uuid": "22d04c0c-c883-4f2e-a62b-38e6f767b4ec", "value": "12288:IBpzRRRRR28iTDSnUxXfojFOkcFo4iM6/4rBpen8e:sRRRRR2/OIXfoGORM6/4rBsT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618911030, "uuid": "a12dcb38-f58d-48a2-b62a-672909d46e0e", "value": 522240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618911030, "uuid": "fba979e1-1547-4ea3-ac92-733ebf3d84a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618911030, "uuid": "98bc1477-9607-4b12-81ae-266e1d4322f9", "value": "PRODUCT LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d564463a-a16e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618878296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618878296, "uuid": "3c847cb0-532f-4786-851b-3265ed228561", "comment": "Malware payload (Dridex)", "value": "bade581641d4cca78384c7f3f7d331ab", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618878296, "uuid": "008122dc-5cd2-4e43-b2bb-42f7a5746bdf", "comment": "Malware payload (Dridex)", "value": "444fdd70489fb4f1468096aaf54b52b03c5f9f0f8f048a7de65ed66b41a3707d", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618878296, "uuid": "0ea8b46d-e5e1-47e3-9507-5118ea1f3f50", "comment": "Malware payload (Dridex)", "value": "c630202a1d821994b898c3b465d4d53c60775b2e", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618878296, "uuid": "82f199f4-0319-4d43-b6f9-dd0bd034bf3f", "comment": "Malware payload (Dridex)", "value": "d7f9972b3c3b4008d005b4fbf1c3dbc9de5e6763abc475a26049528e2f524747c0f3ac85b3d4cd297d91f338771df227", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618878296, "uuid": "3daf3d39-16fe-435d-b86f-8627c44bb911", "value": "FAF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618878296, "uuid": "31ecf21c-50e1-4bf2-b6e8-2bd10df37cc0", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618878296, "uuid": "8394a9bf-c12b-4332-be78-e89faeb1af34", "value": "3072:MWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:M42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618878296, "uuid": "e8c60d05-15e8-40cc-b2bc-cf923a183456", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618878296, "uuid": "45d638cb-a922-4a49-8659-7575537a7e7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618878296, "uuid": "b50aa222-0571-40d3-91c3-e130b8cf1ca1", "value": "444fdd70489fb4f1468096aaf54b52b03c5f9f0f8f048a7de65ed66b41a3707d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3326c6f4-a1cb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618917967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618917967, "uuid": "e81be6f9-91d7-4e55-8c2c-8755e5ab1612", "comment": "Malware payload (Dridex)", "value": "9e0da43d4d2695af5ec9aa66272b4d05", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618917967, "uuid": "92336a17-8c75-4ae4-9536-62ad0c1c75b7", "comment": "Malware payload (Dridex)", "value": "446bfc6770604ebe4d10ac173dbaa272b0d195716e36d9456530ff535b676fe9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618917967, "uuid": "9b771c1d-26c9-4d38-93fd-e4dcb52beabd", "comment": "Malware payload (Dridex)", "value": "5c2229809600b2410216a0150c0b859cb40436b4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618917967, "uuid": "4312182f-4909-47db-a4ca-64783e9e285c", "comment": "Malware payload (Dridex)", "value": "d9cbd9b235f63a2d94c26c3c675d2cb0f79018d8d6af3362cecbf24c6572fb6935d64ab39c9ae3ebc3b1e52c33ff601f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618917967, "uuid": "7317d5f1-8dfa-4c77-b05a-ba196a526992", "value": "D9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618917967, "uuid": "f9b95dbe-b503-4728-8892-247a1ce59453", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618917967, "uuid": "a5f35a80-a5b9-447c-8db3-062a7ff596d5", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618917967, "uuid": "e9060c16-ba2b-4358-9c87-2e34dc4edc11", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618917967, "uuid": "4f82da04-b670-4171-bd4f-36dd634eb177", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618917967, "uuid": "7c7a62c6-775d-498b-9552-389ca637a182", "value": "446bfc6770604ebe4d10ac173dbaa272b0d195716e36d9456530ff535b676fe9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21cff93a-a20e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618946714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946714, "uuid": "fbcf726b-4c19-4013-82ad-a8d5d6e6c75c", "comment": "Malware payload (Dridex)", "value": "520ccf10c718b149bda6961904ee3c99", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946714, "uuid": "bc7c7f10-8523-439c-a3de-d32101192d21", "comment": "Malware payload (Dridex)", "value": "44896459f6bb499884eb9c7754c604a18534552aab07705645af65de92751694", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946714, "uuid": "076a8c2c-05c7-4929-a321-56c5ff870616", "comment": "Malware payload (Dridex)", "value": "abf9e310a58cbb5bcee471446ca200869083dba4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946714, "uuid": "e216649e-3319-415c-b8a4-8415aafe9211", "comment": "Malware payload (Dridex)", "value": "fe89139a4941b17af9d67ef985af3a137a4f97e7ebc8835cbe1503446821dda78952611c95d63ed30d95fcc5fc4bc51a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946714, "uuid": "6d248a4b-d789-4cef-b654-04bb4bfba7de", "value": "D6F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946714, "uuid": "a2508e98-524c-41d5-8e55-540605fd57e2", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946714, "uuid": "5d89ad04-a8a3-4fd7-a59f-5b573d61f860", "value": "3072:3wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:3wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618946714, "uuid": "61b88aea-68ae-4ef2-8fe4-9a34968167ee", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618946714, "uuid": "41fbf280-0bc0-4f1a-83c3-85084c6ba4f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946714, "uuid": "6b700899-5db4-4659-a07d-84bdad2d8cd0", "value": "44896459f6bb499884eb9c7754c604a18534552aab07705645af65de92751694", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53bb6da-a1f9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618937969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618937969, "uuid": "0eeda2a7-5a10-48aa-ae94-0cbf5b903bcf", "comment": "Malware payload (Dridex)", "value": "757c93769ef5a2a2c39e60a37415270f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618937969, "uuid": "865f99dc-c2dd-4ab9-ac7b-537051a8942c", "comment": "Malware payload (Dridex)", "value": "449b8ee1db28249f6bf37a036a44c063b2baab74cd86bae5dbe5d5bd027571c7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618937969, "uuid": "8eaab9e9-b527-4ee9-bc3e-4183df326da4", "comment": "Malware payload (Dridex)", "value": "768c33fdcd36e5f6ae9d699a439a3327bb6bba31", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618937969, "uuid": "4abc9740-55f3-496e-ac4a-f2b86e9a0baa", "comment": "Malware payload (Dridex)", "value": "3b2413a89838c6d2455d7809f04afb65cc3cedf97764352c76d239c95d9c4fb11bae0e808421b3fd5c39334bedc47166", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618937969, "uuid": "3bdd8099-5c46-4ba5-99b5-b6a10173fc99", "value": "2FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618937969, "uuid": "a7fb5dd0-2cb4-4251-a3f4-58fde5be66cc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618937969, "uuid": "3cb97ed3-74ec-4e3b-89e5-036e6f94b790", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618937969, "uuid": "3bb9c8d7-0ce0-41b7-8ba1-33df62d6ad83", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618937969, "uuid": "2d8b1b80-d136-4863-9673-021bda81d65f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618937969, "uuid": "409aa500-8e6f-44cb-b6bd-a187cc9bc580", "value": "449b8ee1db28249f6bf37a036a44c063b2baab74cd86bae5dbe5d5bd027571c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49659267-a1d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618924017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924017, "uuid": "6afb2585-29b4-47b7-a906-b4a0e95de832", "comment": "Malware payload (Dridex)", "value": "ba25942e9b5ac1a7355ac6299cefbe16", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924017, "uuid": "f84d8c46-d9f9-412f-8d4b-d53cbc74a7f2", "comment": "Malware payload (Dridex)", "value": "44c70311e114a91c3bce8a6b7da0ae329ca332c1b448563bef9f143ef84e6f25", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924017, "uuid": "35d27bb3-1dfa-40af-b440-5b301a425c3a", "comment": "Malware payload (Dridex)", "value": "df5211c5e49637a2aa31a7dbde300b6c89e7896b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924017, "uuid": "42180786-1277-4e71-a121-dfc1092f4cfa", "comment": "Malware payload (Dridex)", "value": "8aaa833d039562b79e7e553be6694caf297e949128855856792eb1c4ac93b55ad7b0007c20c59e3cf76d4f9292a4eb95", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924017, "uuid": "7f763ede-310a-4655-9d10-0636612310f1", "value": "94F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924017, "uuid": "e53efb91-6dfd-4ece-8b40-a9883ae3d0e2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924017, "uuid": "03a1ea21-16c0-48cb-be97-75fa46d23c0a", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618924017, "uuid": "d6bc8b95-d6c1-4d7f-8d46-f13a61fb7eac", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618924017, "uuid": "80b2ed4e-e740-40e5-ba8b-e14c330d7936", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924017, "uuid": "8f1e3421-a3ca-4143-bdd6-ed4931554401", "value": "44c70311e114a91c3bce8a6b7da0ae329ca332c1b448563bef9f143ef84e6f25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a12850-a218-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618951198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951198, "uuid": "bda641c6-7b6f-4450-a43b-4dcc0f21c1fe", "comment": "Malware payload (Dridex)", "value": "e6d3737ecadd05e557256319664027f3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951198, "uuid": "b905310e-a2ba-475d-b57b-9352c16c4cf2", "comment": "Malware payload (Dridex)", "value": "45751d8420076c8f9f72d884e63743b2a623d61b7bd52bd7f6dd5f75b5c0e673", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951198, "uuid": "405f6c51-db22-4860-9773-f1956e630a39", "comment": "Malware payload (Dridex)", "value": "a218a63259e68e37db51b5ba40846c539fb60bb8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951198, "uuid": "46b93af4-5a8d-4eab-9b47-7bddf06942ed", "comment": "Malware payload (Dridex)", "value": "eda148840691e973d0bda281635a5acbe58ee39c8ec3c4c2286f9c4fe63b47be31e7f1e2ee9ebf7cddb15b5f249efb2b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951198, "uuid": "96ae8bf5-a5f3-48f8-b5f5-934f8a3a4762", "value": "C4F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951198, "uuid": "0b77deca-3769-43be-a690-65c2de068112", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951198, "uuid": "0906051a-8da9-4f27-853e-04d5fcfd806f", "value": "3072:GwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:GwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618951198, "uuid": "e5bf9a55-12fd-40a6-a03e-947df77f0be4", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618951198, "uuid": "c485c73c-4d8c-4323-9635-44d389e674ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951198, "uuid": "c82f40e3-f4be-4fb3-a0f4-331d4f7508c2", "value": "45751d8420076c8f9f72d884e63743b2a623d61b7bd52bd7f6dd5f75b5c0e673", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cda3bf4-a20b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618945632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945632, "uuid": "4667d24a-5110-44a8-9b66-691c14c0df5d", "comment": "Malware payload (Dridex)", "value": "1380ed37617a6b23bbbd681bee60645f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945632, "uuid": "31e40c49-fdfe-4eac-87ac-e45ba36b63ce", "comment": "Malware payload (Dridex)", "value": "459bf4366b0b2fe220dc4b2a5a8004b29eaf584d809b3916ff84352092d72372", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945632, "uuid": "9ec62d7c-059f-4004-b2f5-4715f068518d", "comment": "Malware payload (Dridex)", "value": "95fea46a57d89f3a1752e2b10dfd4b87d91ec5e0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945632, "uuid": "23e45804-af43-4341-a3d6-312771ab367f", "comment": "Malware payload (Dridex)", "value": "1586cb6645c2129027c836e44c68570f0958f349dab41514b0a6e21ca619891692e4a48dfaeb86f30d3a060d72ef12e9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945632, "uuid": "34ae01c4-bfeb-4baf-8a30-f9d8a7ca6681", "value": "A3F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945632, "uuid": "0854e445-e965-43b0-802c-83e69782f77c", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945632, "uuid": "02e5b6f3-6fe1-4ee7-b2d0-2cecb6a58e22", "value": "3072:owZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:owZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618945632, "uuid": "57d7e34b-96ff-49e6-99da-93378536a4d1", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618945632, "uuid": "6eac905d-06ef-4b09-a3be-5d6a6a6e8ce6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945632, "uuid": "711c94e0-3b38-4c6c-ba9a-4fa2b15221e0", "value": "459bf4366b0b2fe220dc4b2a5a8004b29eaf584d809b3916ff84352092d72372", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c4a69c8-a1a2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618900534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618900534, "uuid": "6943d310-e166-4622-9b41-0e94df98a138", "comment": "Malware payload (Dridex)", "value": "49d23da902af1e0ee5be058838655120", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618900534, "uuid": "9092c0d8-16c0-4750-9ccb-548dcfff9537", "comment": "Malware payload (Dridex)", "value": "45a6039f350b2b6c93bb4096e9e5e1d4f25d35691a7ba11ad2cfd27c4da30948", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618900534, "uuid": "d941f651-9dd1-4354-a415-aeee65e3cda3", "comment": "Malware payload (Dridex)", "value": "42b92863e8365b7389f71b6bab2f630eb14e7ea6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618900534, "uuid": "ff43b47c-0466-4586-80fd-6b648d3dfeec", "comment": "Malware payload (Dridex)", "value": "e2a01a867eb1f8d0625cbc22df035641b4b1da3fa8ed7d1cd31426df240f0fa4dd5a5f9e7dcc738bbe67cef249f91583", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618900534, "uuid": "84ed5004-d25b-4593-801c-6dd884e74697", "value": "69F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618900534, "uuid": "46c9fdfd-a22f-4a91-9d14-a68f361a8836", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618900534, "uuid": "ac6cc8b2-d428-4254-bbfd-3a239580b6cf", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618900534, "uuid": "e20c311f-7380-411b-a0de-bec7e2b2741c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618900534, "uuid": "204cc779-d19c-4995-ba6d-7a1c91784ee6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618900534, "uuid": "3be6b3e1-64b7-4cd4-a33a-48ae968f7235", "value": "45a6039f350b2b6c93bb4096e9e5e1d4f25d35691a7ba11ad2cfd27c4da30948", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d503a83-a200-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618940694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940694, "uuid": "6924e03c-f563-428d-93f7-ddabb592323e", "comment": "Malware payload (Dridex)", "value": "bc54f74c4255d26b0f6e2aecc227f930", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940694, "uuid": "b43362ca-c6d3-4944-b1fd-fa3b9d3d5432", "comment": "Malware payload (Dridex)", "value": "45dd6d84c6e2f50e273df0dc46983368474add7b1f5ff461852623cd7fcc50c8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940694, "uuid": "4f0e81fa-926c-4116-9031-481e1f1547a2", "comment": "Malware payload (Dridex)", "value": "cf8e2766018df5bd887634c0a72c5aefd28eac79", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940694, "uuid": "e414f5e9-23ed-49ca-a76e-9ee88e1182db", "comment": "Malware payload (Dridex)", "value": "9e40559f35b2d9796ecee000121ac83011dd1d45c8444da8a86afd5717c11c7a1e1db16793d3f111e9e9b56e0ac2bcbb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940694, "uuid": "c1d9c469-1627-4657-8e2e-9ce0dd678280", "value": "ABF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940694, "uuid": "be984fcc-e24f-4eb4-8714-9ac98c106653", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940694, "uuid": "4fb4ac3c-4756-4bf9-b792-0987babb410a", "value": "3072:rwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:rwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618940694, "uuid": "2aadc86a-52ad-45b1-9a27-92d3ce91bd78", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618940694, "uuid": "0b2b55a6-575f-4c91-9f23-600d03ad3ca6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940694, "uuid": "d6f5db1c-ec2d-45c5-870c-14fa18293c58", "value": "45dd6d84c6e2f50e273df0dc46983368474add7b1f5ff461852623cd7fcc50c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0176b88-a218-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618951221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951221, "uuid": "b5c7c18a-a788-4b38-91ea-c7d334f169a0", "comment": "Malware payload (Dridex)", "value": "94fdf6918360d5faf225dcd20460350c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951221, "uuid": "4572e601-07db-4b70-ac23-ec8dbacb6980", "comment": "Malware payload (Dridex)", "value": "45e788ba9f38bd728b4461502a267579ec766b9db368a734db4dbad4d48cdae6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951221, "uuid": "c6917c2e-8c4e-4256-bf8b-0dcac6e0bf31", "comment": "Malware payload (Dridex)", "value": "c3e12e8f49a02f8891e6d8fe1a7a6bd555404dbc", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951221, "uuid": "0d74dcee-a0d4-4f09-9411-175596027670", "comment": "Malware payload (Dridex)", "value": "fc9b6a36db673701e61dca5dc9f38b2331eb391dec8026396e6da94b89021ddf15aa5c60cc1762e284665f51ff222439", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951221, "uuid": "8677635d-a80c-491f-9e07-fdc66cc509ee", "value": "D0F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951221, "uuid": "61606f79-8a8f-4564-8283-1e6e1568558b", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951221, "uuid": "97a32fa8-4786-4a5f-8d69-283e26c1b228", "value": "3072:NwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:NwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618951221, "uuid": "21e36097-5ee3-4ee5-8014-fec6a8e6dc20", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618951221, "uuid": "de3d5c32-6732-475e-8fd4-8a55b0757990", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951221, "uuid": "afc658e3-8505-4afc-a066-91d5b1d9038c", "value": "45e788ba9f38bd728b4461502a267579ec766b9db368a734db4dbad4d48cdae6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f8b33dd-a210-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618947757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947757, "uuid": "d3d7e6d3-0c71-48ea-9290-bc3f513a009b", "comment": "Malware payload (Dridex)", "value": "69880f21a784d132a32714766021c44c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947757, "uuid": "5ab58099-ef60-4fcc-a68f-6c6d997ffa02", "comment": "Malware payload (Dridex)", "value": "463e2ecfa5e78141f4c4286bd0a13b4ba87a50776d28452cb38b9cfa5fc1ad5c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947757, "uuid": "7cdbc24e-863d-4d8a-a2e0-c1ec851a7c8e", "comment": "Malware payload (Dridex)", "value": "b54663e8f0ada5f130bc95afefbaf8c4138dd3c3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947757, "uuid": "9b0c255b-1fed-4a9a-aeab-6e6c987b9bfb", "comment": "Malware payload (Dridex)", "value": "195ba961140e327812874b26a2d0694d3feea027946a5a31b2a3f8e66a756c0f489338d037697adc23611157020a416a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947757, "uuid": "eeddd857-aa34-4777-920c-e2e0ed262f9d", "value": "8AF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947757, "uuid": "b03bcb45-f7e9-47f8-9960-a3e880c2f1ba", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947757, "uuid": "ed421129-e0d4-4af1-865d-b5d79af95a9b", "value": "3072:3wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:3wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618947757, "uuid": "c1113226-c7a6-4244-a25a-dd3681527219", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618947757, "uuid": "54945853-5887-4412-9155-a563302dc095", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947757, "uuid": "c1df0910-8773-4dbf-9ec0-02e9916b3d6a", "value": "463e2ecfa5e78141f4c4286bd0a13b4ba87a50776d28452cb38b9cfa5fc1ad5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1dc9ef-a1fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618939755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939755, "uuid": "b184705a-167e-479d-a9e2-205e4416491f", "comment": "Malware payload (Dridex)", "value": "450a987f4b6096686775a5e03a4bf890", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939755, "uuid": "d16abe81-d9a0-44c0-b677-671f442b8a18", "comment": "Malware payload (Dridex)", "value": "469d97168b4eed7f734f6b56a544006defcf44ef5cc8a86b65dd8ed794308d3d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939755, "uuid": "7dd2081e-afb1-4af4-a3bb-8d1a27dfb896", "comment": "Malware payload (Dridex)", "value": "fb4151f7108241728a2c93d5299aaa2f37e80131", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939755, "uuid": "063c35ef-69c6-49b7-9894-c0adfda8057a", "comment": "Malware payload (Dridex)", "value": "8c8058936487d245d9ec84a0b36b63773d69e205e5814ec3a1cffe1beee018410710502f3278d9a07eeeecd51eabbdcb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939755, "uuid": "4b2331f5-e415-44c8-90d8-e26a460ae131", "value": "3DF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBD7D240A50DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939755, "uuid": "6193b393-f61a-4254-87fa-6bf811e1a186", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939755, "uuid": "a4d7bfbf-f6a9-4f09-ba8c-2c1c9041466d", "value": "3072:vwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:vwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618939755, "uuid": "ae14482c-0036-4733-93ef-7276a1f43b85", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618939755, "uuid": "0434af9d-0724-4f2b-a77b-16cfdc59fda7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939755, "uuid": "cdd51b0d-c53a-4393-bed2-fb1486f798c0", "value": "469d97168b4eed7f734f6b56a544006defcf44ef5cc8a86b65dd8ed794308d3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c83198-a21d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618953161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953161, "uuid": "05d3914d-9244-4727-8547-0abb52c3f3b0", "comment": "Malware payload (Dridex)", "value": "0d2c72b8eab3792c00ac889fd8c5339a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953161, "uuid": "11e25fc1-1964-458a-b732-dd5d6d49ec33", "comment": "Malware payload (Dridex)", "value": "46a17eb1470a730e924746ad4f5d9ccd62f556762054c41fc6cd26f6d7ffb287", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953161, "uuid": "59d4e373-f5ed-4883-97e6-6f29e5577561", "comment": "Malware payload (Dridex)", "value": "9f16ac0b2a3e0e2f38688712ef74e56f0d5c4a96", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953161, "uuid": "446c16d9-3f0b-4cae-8a10-7d3343dd4dc6", "comment": "Malware payload (Dridex)", "value": "92db5d78247bad5564ea52fd02570de8bcae096b4d618401a7727e99d2e596f51ecc21efe3551fc4abc6bc0560f5c2eb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953161, "uuid": "70a746d0-265b-4b1c-80c2-80746258197a", "value": "33F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953161, "uuid": "1dd2f553-3d64-4cc1-a427-215da6847a98", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953161, "uuid": "e45e6934-b12c-45d7-a4a1-a40d4b0662c8", "value": "3072:KwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:KwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618953161, "uuid": "f5422e44-1835-43ea-a0b8-5398d832c331", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618953161, "uuid": "5c9e57a6-dc1d-4ca5-92ca-571c9cbfdb66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953161, "uuid": "f426e248-dbc2-4ecb-bd9d-3dab75703151", "value": "46a17eb1470a730e924746ad4f5d9ccd62f556762054c41fc6cd26f6d7ffb287", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d305ad2-a1b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618908213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618908213, "uuid": "f4d74796-1c70-4598-bfb6-a3fdfaf592f7", "comment": "Malware payload (Formbook)", "value": "cb045e8eaa8c74a5b79da54d9cb038ea", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618908213, "uuid": "cef5c562-0457-472b-9923-1f56046286e0", "comment": "Malware payload (Formbook)", "value": "47031aee7dc67644c841246a50bacd54a31d56603c1305d9966fb56c3b3cb448", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618908213, "uuid": "7c9ae585-4820-4aeb-8e55-d4a7b67d232c", "comment": "Malware payload (Formbook)", "value": "d291b57e8a814e02111b0146687dfb09263ab73c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618908213, "uuid": "2a50a944-8687-4171-9f59-bc567f799e4f", "comment": "Malware payload (Formbook)", "value": "9688dbad6e0114a6ea1d21eb90c88840b9634388c1a928100dce7a7cb058629829ec5909562afbf0c648922d6dec1fff", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618908213, "uuid": "af2c0eca-ef5c-4477-b895-11ed8b2c3f36", "value": "2AD47C22A6D04873F15F26798C4BB7B9DD2AB9502D2820496BF85D8C5F3B7913F260D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618908213, "uuid": "2068fa98-e29f-45d9-8693-9e2098d7f8e8", "value": "9f60df8623e7a0b5c75b8592476fc1fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618908213, "uuid": "dbf2be05-f40c-4751-bb98-556ba6ec6915", "value": "12288:PadRF9SjV24ePQJhMp91NdtzXyLT2l1sQCLVEFM8L7:PuFAw4e++LhI9aPL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618908213, "uuid": "2a8e1a65-aa83-4c38-aac2-c9769fbaae9c", "value": 608720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618908213, "uuid": "e9039f67-01ae-41c5-addc-a81f9204a8aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618908213, "uuid": "19c15160-6145-4561-830a-e5a2c45b346d", "value": "Bank swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd1b9d8-a202-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618941765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941765, "uuid": "f5eb1ef5-ec84-4de0-8e87-acdacf25b38a", "comment": "Malware payload (Dridex)", "value": "fc6ae41071cfa9a72ef97cbf6d08237b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941765, "uuid": "436f2acb-eed3-4f1f-8655-8bdca4a3e7c3", "comment": "Malware payload (Dridex)", "value": "472927a053ea658bd1a22664fb7a6f21a992cbdd1f8cf907a987516e151b03d5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941765, "uuid": "32ede5ae-48a0-4644-8f08-61a7840dca17", "comment": "Malware payload (Dridex)", "value": "2ecf2aad53f71bf200a85ef18c5332197a7658ee", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941765, "uuid": "88372b45-41de-4101-98f6-812d647f8517", "comment": "Malware payload (Dridex)", "value": "102d19b294ec9d16bc5cc36389c0c21fb681e71b5365407789bdf60b6db9ea0e10ff54a3196b3e0808208a541e0ad01a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941765, "uuid": "b89c3eae-7ec5-4523-9b7d-a26e89521c24", "value": "D5F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941765, "uuid": "da753fe4-5d7c-4d06-8976-a3564786a305", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941765, "uuid": "9dbc0453-e2a5-4992-b540-a353ce52618e", "value": "3072:EwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:EwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618941765, "uuid": "68dfef04-2299-43b7-9b6d-0cbe91ecabb5", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618941765, "uuid": "ee869b69-af41-48f3-9c7a-b019669c529c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941765, "uuid": "45476a9d-5ee0-4e41-bf02-027902aba128", "value": "472927a053ea658bd1a22664fb7a6f21a992cbdd1f8cf907a987516e151b03d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaaf1478-a201-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618941360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941360, "uuid": "166e8f3a-646d-49f1-ab85-da4131883857", "comment": "Malware payload (Dridex)", "value": "f9e4c9b1e28bcd2c6bcdc0cd80a2eb28", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941360, "uuid": "53f5bf9e-bc4e-47a7-9218-ba208413509c", "comment": "Malware payload (Dridex)", "value": "4793bc92803ccb8853e856393b5582ecbb222c4bd97468640b943ac8e4ad1288", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941360, "uuid": "89dce6bc-5ea0-4f62-9f0e-c1de40f96d39", "comment": "Malware payload (Dridex)", "value": "e3bbf70bbb50f4d435d6c21a8e699f117d9d0ed1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941360, "uuid": "295c4b5c-ec90-4e4b-be28-410251aa2308", "comment": "Malware payload (Dridex)", "value": "e7c469e2819be1ff262fd29a82c4ed52d733397911a75a47c6eedbbe19b4f8a4e0489e7dd1cf1cad1e03fe0af5a99b7c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941360, "uuid": "62769ead-cf29-471d-8f55-843edf58a8a8", "value": "D8F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941360, "uuid": "9c8e31db-a6e0-44a1-a568-f0d4f9075913", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941360, "uuid": "30c0fa88-5eea-41d6-be0e-fcd3689a2b45", "value": "3072:+wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:+wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618941360, "uuid": "fed0e90a-a943-47c1-9eec-5134079f87fe", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618941360, "uuid": "cee8fb03-4971-442e-a75b-27462c869ff1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941360, "uuid": "cdbcbfd8-adf8-46da-a25e-5dda39a73267", "value": "4793bc92803ccb8853e856393b5582ecbb222c4bd97468640b943ac8e4ad1288", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827998c3-a207-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618943870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943870, "uuid": "31313ef4-4176-4187-b622-5de0e4bea0cf", "comment": "Malware payload (Dridex)", "value": "29a1cb81159dab9c284f4075202390c6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943870, "uuid": "80976c2c-c95c-4876-bf60-ab107cd3624e", "comment": "Malware payload (Dridex)", "value": "47d3e912d0cf0e0c8f9940bc7950f0afebb2ee03d415c4dc1556bb695f78df50", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943870, "uuid": "f4a5a72e-cabd-4457-84b1-bb34dbf81e26", "comment": "Malware payload (Dridex)", "value": "350abe9fac7a64aa8a0c5b876bf0e7ca42b8c2d2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943870, "uuid": "b3c8262a-6506-4abf-9417-0c5670416fa9", "comment": "Malware payload (Dridex)", "value": "c689f6d902f7b782fd2a42f8094810bb3a7ee9bf2ba35c7631e1fbd4edf920b5795d5f4374d3f29578d95201501cd830", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943870, "uuid": "051f5559-0d04-43f1-8f14-ca9ef6f3534e", "value": "74F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943870, "uuid": "acff06ba-a8d8-4077-90f9-6827e61c9a0c", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943870, "uuid": "a21f8d57-817e-4613-84cc-e79d65f3eced", "value": "3072:7wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:7wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618943870, "uuid": "ab43709a-773b-4016-beb8-afe6e0c531cb", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618943870, "uuid": "8cbcd183-2f94-4d85-8e23-96d7c9be02d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943870, "uuid": "4cffa785-c870-4ee5-a488-5f697faa3969", "value": "47d3e912d0cf0e0c8f9940bc7950f0afebb2ee03d415c4dc1556bb695f78df50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eebd1de-a20f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618947327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947327, "uuid": "8d16e351-bfb7-4fbc-bb1e-2cd6921b9664", "comment": "Malware payload (Dridex)", "value": "07ed0a19f47240fa56c318f473112074", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947327, "uuid": "e5750aa8-bb51-4049-8a97-aacbf25f2772", "comment": "Malware payload (Dridex)", "value": "482f7aeb02be26b9ee4a3e064f26fd2e49511a7f422832c866c6fbfc5bf2f38a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947327, "uuid": "ce6deb4e-a07d-47a0-bad0-d9cbf72f2547", "comment": "Malware payload (Dridex)", "value": "943e38a6363fe37039a458d6736e8d2821a7c6b6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947327, "uuid": "078a4a1a-52b6-4ff6-991b-e64324302571", "comment": "Malware payload (Dridex)", "value": "eaa3246a50468344e0fae223ea0f46cee2093f43a9b98b90e3f35a1d677fcde7116e498884acd5650be9ccae918411e9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947327, "uuid": "bacd89e8-fe93-4135-b986-ff3885d48989", "value": "18F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947327, "uuid": "9656654d-12c3-4576-98d1-5b94a241141d", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947327, "uuid": "c78c9371-946f-445e-8f0d-9b035df6a328", "value": "3072:vwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:vwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618947327, "uuid": "34c20dc6-73f2-44c0-8601-53909f7a0a17", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618947327, "uuid": "b92236ec-9ea5-4fbb-9c1e-0dd96dd2f522", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947327, "uuid": "0b32f8d0-b990-42bf-9a79-e8259793bd83", "value": "482f7aeb02be26b9ee4a3e064f26fd2e49511a7f422832c866c6fbfc5bf2f38a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3222b55-a226-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618957239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957239, "uuid": "e1f82f41-ff31-46f0-ac64-fe4058900e21", "comment": "Malware payload", "value": "80221f2a82eaa8c2a5c39b98c48d346f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957239, "uuid": "e5720136-5ab1-426d-b12c-49aa3bf3cf30", "comment": "Malware payload", "value": "4843516d1212249fef540cf95023af1847efca09034a8b9f8fbebc342e5aa03b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957239, "uuid": "f12f0db4-5fc0-4291-a8e0-20ba9ba2a8e0", "comment": "Malware payload", "value": "79d0476d00bc492fc8a89486eca85c206c79584d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957239, "uuid": "42b781e6-fd3b-435c-a366-5e57aa3ddf24", "comment": "Malware payload", "value": "2e0bb105078d5ba542d56a831cba5ac19123cb0bada78dfcd523e840969e3e32205b6e84b8472c59e02a7a0b7e47bc63", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957239, "uuid": "d6c631fb-dbab-4bb6-8cdd-048e89d7e942", "value": "FFF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957239, "uuid": "816ed182-a74b-4290-8109-03a130e15628", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957239, "uuid": "0d086821-1cc7-4332-a89c-4767d4f8136c", "value": "3072:YwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:YwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618957239, "uuid": "ccf60bc4-67ed-4ed8-a6f0-504ac201f804", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618957239, "uuid": "a67cca9d-92a7-458a-9706-8098f64da7c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957239, "uuid": "7cfbbbae-57c8-47c2-9b7b-9bc701fd2f35", "value": "4843516d1212249fef540cf95023af1847efca09034a8b9f8fbebc342e5aa03b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ab6fb6-a17d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618884556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618884556, "uuid": "18117bea-c973-4119-9b48-d6140f9b88b6", "comment": "Malware payload (Dridex)", "value": "287ad6c099e2b827d9a059adc36fabee", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618884556, "uuid": "ce324cf3-0c7e-49ba-857f-8fac70efb369", "comment": "Malware payload (Dridex)", "value": "48acf00afd6cf29d20bd5e590074ccc49c4d43e20bdda4410bcd8672bca532b9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618884556, "uuid": "ab93490f-7ff7-49de-8898-ab7e78999a34", "comment": "Malware payload (Dridex)", "value": "6942047ebd35a041b643811f17ebf361383cf200", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618884556, "uuid": "a3cbaaf9-d13d-4af5-bced-4ac41efbe2cb", "comment": "Malware payload (Dridex)", "value": "c8b73a816959c40b2067efe27958ed7c6447c69d638cf6ee36083ff76602dfcb781d66da058b4115efb9f6e3b715a1b9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618884556, "uuid": "1c68c5f0-e21a-4ce5-8f66-794cb552ebd9", "value": "4CF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618884556, "uuid": "5bc4dec9-3158-44f0-a432-16953d39379d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618884556, "uuid": "9372e15b-41e9-4259-9b5d-0302858a64f1", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618884556, "uuid": "d689b566-6cc6-49a5-917f-6bba9381bf6f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618884556, "uuid": "5eb08432-5f2e-4c52-851c-10a910b8fd9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618884556, "uuid": "9da18c2e-cf2c-4c04-bb49-53ac5b8752bd", "value": "48acf00afd6cf29d20bd5e590074ccc49c4d43e20bdda4410bcd8672bca532b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9076bc47-a1bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618911681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618911681, "uuid": "e8beb9b6-2e1c-41af-a529-64854ade8ddf", "comment": "Malware payload (Dridex)", "value": "7e35e00bbd6fa0593c63a3ea8e050d69", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618911681, "uuid": "dfd54d66-89dd-4307-99df-f0fe66ae5de1", "comment": "Malware payload (Dridex)", "value": "48bef9e90d8a5d98ac60cc0cec45b7424bed25749869a2239e1ea1909bf31ed1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618911681, "uuid": "1cce31a5-882b-4f80-86f7-7cefdf69ffe2", "comment": "Malware payload (Dridex)", "value": "dbc301b90bc18bf46ef449707d1b5420c86e195f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618911681, "uuid": "ceecc596-d54f-427f-8804-c5ff2aba304c", "comment": "Malware payload (Dridex)", "value": "9d745ce0fcc18b335838d8caed078fd0c4cb51e4461385a59158b891b13f00fcb35e008fc8a36fc3b59ef9c2d1d6945c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618911681, "uuid": "78d622fd-aec8-411a-8c3d-e78e52f56cb7", "value": "CDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618911681, "uuid": "3c9a1211-7f8c-4230-891f-28713aa4a079", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618911681, "uuid": "d3b56048-b3f5-4065-a3cf-9c4a7bb45b03", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618911681, "uuid": "76b67e70-dd41-4653-a1d6-2ad134625498", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618911681, "uuid": "a354b8de-7927-4a7b-882a-3aa5f96da4a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618911681, "uuid": "b211d9a4-5cee-408e-a808-1757c4063613", "value": "48bef9e90d8a5d98ac60cc0cec45b7424bed25749869a2239e1ea1909bf31ed1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14cad403-a22d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618960007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960007, "uuid": "1962ea38-1f85-44c1-9640-ae746fa76eda", "comment": "Malware payload (AgentTesla)", "value": "d0e94f7fcace629ef4fb380a153b9a08", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960007, "uuid": "930f4d5b-a86a-4596-94dd-b058d5f94130", "comment": "Malware payload (AgentTesla)", "value": "48c924f82bd6834da53cc497a77ff8425df86fc01d05636c960d246e1fad08e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960007, "uuid": "68d5ff3e-28de-43d0-8993-d9c5fd56db90", "comment": "Malware payload (AgentTesla)", "value": "60833ad817666a2db44e4c6f41f96c9ebff74c63", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960007, "uuid": "652b6bd7-fd7e-4f51-8f89-1830b3c86ea4", "comment": "Malware payload (AgentTesla)", "value": "7f4f4038d40490a3cea2b373d7b28888c1f211ba3b3588d604f68aa46459c8ce93995574defe2f35c2c9034adac0a362", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960007, "uuid": "b531907c-97a1-499b-b827-7557c7e4e499", "value": "C1E4F1213394E754D4BE07760854664063FFFA1BA722CA1E2CF8315D9EA7BD683217A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960007, "uuid": "7aba3c5c-f839-4e74-b735-f802c36e5841", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960007, "uuid": "518fcf85-f686-4f53-9675-af66fe7555c0", "value": "12288:VT6m5ltzRRRRRe08VBdk/j4Y3dvtkWN0xEAH+SOCyPmnvkZUV+3arxaYtsYkj8:VPhRRRRR78+5NlrNFAHvOCyGHgK8MsH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618960007, "uuid": "fd73d7d9-ceac-4f58-bb46-6713e5f12c6f", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618960007, "uuid": "474e266d-c6a2-486a-a5cd-90b4edf4d4db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960007, "uuid": "331579b6-c9b8-4d9f-9e4e-e939b101ed40", "value": "Quotaion 4-20-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4aa69f-a221-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618954897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954897, "uuid": "434aa128-4243-4231-a202-0cfe1effa386", "comment": "Malware payload (Dridex)", "value": "ac85a3b8651b72b64aaa69395c1552d2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954897, "uuid": "ca282ffe-2c21-45ca-bb73-b993a7481249", "comment": "Malware payload (Dridex)", "value": "48d5aac2cb2d59049b0cf1b13ae3ed5e1809dc704f25f1c15dd4a14ace194741", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954897, "uuid": "424e8a98-b96c-4a44-9da2-617d09fef510", "comment": "Malware payload (Dridex)", "value": "a1153d1b7900b78870e9b73a2233a41b4f2493bc", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954897, "uuid": "36a3b51a-ad95-4a8a-a929-9a99e45ad7a6", "comment": "Malware payload (Dridex)", "value": "c82e4410cd50f8ee16ccab013655219611f5ff1d83df9dcd6b1c3cbc6b9a7281274de600005685b8d9f11d20249c34bb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954897, "uuid": "50972488-15fb-403d-9412-3d1eb5607325", "value": "D1F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954897, "uuid": "d0e19dbb-44c8-42d7-b230-be4fca39fd58", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954897, "uuid": "acaad449-ddd1-413f-a7e6-abc814d0ffea", "value": "3072:CwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:CwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618954897, "uuid": "64953f68-39c6-4d2c-b8f5-3f7da700a73f", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618954897, "uuid": "7212e8ee-3f22-4e23-8269-2fb3010ee6c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954897, "uuid": "f37770e6-ffd4-452d-a264-f0d12002e067", "value": "48d5aac2cb2d59049b0cf1b13ae3ed5e1809dc704f25f1c15dd4a14ace194741", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f363b144-a177-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618882212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618882212, "uuid": "9457627f-4e0d-451b-9eff-368263fe06f8", "comment": "Malware payload (Formbook)", "value": "4a391bca07af23a8e735b4e4bba0a195", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618882212, "uuid": "15f8cdc7-d8fc-4d5a-9ff0-4977824bc9b5", "comment": "Malware payload (Formbook)", "value": "48d5d5bc835c9bfa24c2f7fb0e3149190639d1d53eb99fac9b6a97df0f6d2908", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618882212, "uuid": "73c2d93a-fcc3-4117-929f-e415608e4302", "comment": "Malware payload (Formbook)", "value": "8bd5c99ed285cb37429a7bf4a6e14012e4c04e1d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618882212, "uuid": "d22f39f3-8e17-41dc-b807-05604b3c18f2", "comment": "Malware payload (Formbook)", "value": "90732a9a81487a1d5b586694263319513657c798e3b4cfe501a5274f156676e05a4d993a3f0cec39b37f43bdcb4d7cfb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618882212, "uuid": "6c1d538f-e78d-4481-b729-101896c03b70", "value": "B864F160E4009151F9709A76D2F6992077E6ACC1ACF6FE19A8D9B25731F33E304A5E0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618882212, "uuid": "5fc596a6-c165-4c29-b936-9c5ad69631e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618882212, "uuid": "ea8cd765-b630-4fa4-96c3-acc43ebd2c07", "value": "6144:W9GW0GoltHBYjbbtui/mm5406SyfCyZihhyq8LX:UDspBYjlu6wPzqd8LX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618882212, "uuid": "1bf3e9ff-c6ea-497f-b119-0baf562b80f2", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618882212, "uuid": "1346b730-6471-4309-aa40-5d6104afa587", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618882212, "uuid": "cacfa494-7c03-4488-8c29-b690b3bf1898", "value": "48d5d5bc835c9bfa24c2f7fb0e3149190639d1d53eb99fac9b6a97df0f6d2908 (1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f2287a-a200-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618940762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940762, "uuid": "ea8c9046-d987-4412-afe9-b804e77df590", "comment": "Malware payload (Dridex)", "value": "60866955436cdcc1a3c01701705238ae", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940762, "uuid": "0cca9d09-e846-485d-acf8-4953c4069629", "comment": "Malware payload (Dridex)", "value": "48e07cb488b440e8224777b48b48b110d82ab798dde95f195115753eafa8f3a0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940762, "uuid": "d744eda4-a130-4af4-be34-e4dc4457d008", "comment": "Malware payload (Dridex)", "value": "afe650722cdf567454b0a0a7332b0e754e6d2c18", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940762, "uuid": "a22c376f-1829-428f-862f-70f1327507d9", "comment": "Malware payload (Dridex)", "value": "0aac6f0b6c5578c5df266b48f6e9c171d6c510ec7189cd75802daf15f158eeb588fbc5b2a23ae4efb0205e1719537215", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940762, "uuid": "0f1a4c40-37b1-4966-b7d8-3b5c749c8cb6", "value": "28F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940762, "uuid": "6fa836cb-3ffc-41d8-8eb7-f77e8ebe646d", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940762, "uuid": "8939de4c-2e91-48bc-b555-7ade93c0908e", "value": "3072:KwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:KwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618940762, "uuid": "08f1c31f-8667-4847-a082-2440058b4603", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618940762, "uuid": "00460d92-7fbe-4eda-8eae-c195959e0653", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940762, "uuid": "f319bf9d-8bc6-4500-add3-7dab05e7c104", "value": "48e07cb488b440e8224777b48b48b110d82ab798dde95f195115753eafa8f3a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9710e24-a16b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618876987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618876987, "uuid": "5c9b0675-f642-4d95-82b7-ca2d9d2440f3", "comment": "Malware payload (Dridex)", "value": "4dbaab58a3726999924aca6cc93182ab", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618876987, "uuid": "ead1f2bb-c64e-46d4-aee0-430489d0e8a1", "comment": "Malware payload (Dridex)", "value": "48e15a34a961364e64698ff135523452fcf9e32a46cd0a08822fb47f70b7cc7f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618876987, "uuid": "a7348783-6775-4917-b7da-bee87da3879b", "comment": "Malware payload (Dridex)", "value": "b8e4075325a90f8b116e8f5ba500fb79c4b4b744", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618876987, "uuid": "9a6f5f2f-f38a-4142-bc4a-d19de795f5fa", "comment": "Malware payload (Dridex)", "value": "9dd428b0ecc2594779effc5341c39579a2de5b14475f4f66471f3edd0a0d9457cac5224b590419012b666d722340e492", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618876987, "uuid": "1f81ed3f-773e-4db5-97fd-5ac45e71b144", "value": "FDF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618876987, "uuid": "d9d35558-f901-421b-bc36-9d83dc4d02b3", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618876987, "uuid": "a014894d-3506-43bf-b07c-4f78bd923c38", "value": "3072:YWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:Y42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618876987, "uuid": "92bbc3b1-8ed4-4b8e-8687-b7fa71597fc9", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618876987, "uuid": "735a20a1-96f0-48ef-b0f5-cacdab537219", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618876987, "uuid": "a8bda661-27d2-4f9b-b0fe-2cba798e7f8c", "value": "48e15a34a961364e64698ff135523452fcf9e32a46cd0a08822fb47f70b7cc7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0beaf2-a209-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618944797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944797, "uuid": "d8c5d561-4bc7-4551-b5aa-e4a28a011d33", "comment": "Malware payload (Dridex)", "value": "260c6cb3b4dd6654c969e12450d7aa9c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944797, "uuid": "2448b087-cd10-4c57-bfc9-d42167381bc9", "comment": "Malware payload (Dridex)", "value": "49089a30167943da9ea98bcd54028453fde85f4d3f20d7151f41859ed88c04ea", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944797, "uuid": "0a823c8c-ab8e-4562-bbce-18c2bf71f939", "comment": "Malware payload (Dridex)", "value": "29eb2ace3b58303438dc7ddbdf9c19a124064aae", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944797, "uuid": "7e7fe804-742a-489e-9388-e6f56c2d6626", "comment": "Malware payload (Dridex)", "value": "537d68139ec2952a8bbfbfe6e159578696f576a3c544a10fc3888d75e83f5b9a0f08a2ba8835b9cab59310f7d5035cc5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944797, "uuid": "6ac7296c-ed87-4c99-8e1b-67160ac0bc1a", "value": "18F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944797, "uuid": "160cad28-591a-457f-8c67-7ae246fa7d85", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944797, "uuid": "a62675bb-0443-415a-8fcb-1e42f48991d3", "value": "3072:DwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:DwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618944797, "uuid": "e2ef6c03-788e-4ff9-971a-f42384ab89e5", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618944797, "uuid": "f7327a79-3e46-4251-8566-70bcfada0a67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944797, "uuid": "fd0df490-f49f-44b0-94ef-6405ad838550", "value": "49089a30167943da9ea98bcd54028453fde85f4d3f20d7151f41859ed88c04ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1a1164-a20a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618945010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945010, "uuid": "2a497fc2-d359-41d0-97d2-8e2c6ee4afee", "comment": "Malware payload (Dridex)", "value": "6c1a367dbea2db276460c1973a3bab89", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945010, "uuid": "50c174b1-c12f-46ee-b633-a8ea667aaa92", "comment": "Malware payload (Dridex)", "value": "49141764e9ccfac2303707ec87b3efbb0a3e24ffb3cc237a174f21a9a74cc8da", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945010, "uuid": "ba900e2b-a3c3-4211-a560-f2fc2baa3cfc", "comment": "Malware payload (Dridex)", "value": "51c41ac8a9ece3109a8ecd4035662ff069c4bd78", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945010, "uuid": "a617521c-028f-4a21-b06a-fa698bec62c2", "comment": "Malware payload (Dridex)", "value": "ada3afd239ebd5ea300eb8d234ad15b9b03c761b3b1fc5ea455bcb36ce08a79d0214a252ec544a3e828af0e96cf5f490", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945010, "uuid": "591d9059-49f0-454e-907b-db80c6688928", "value": "A0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945010, "uuid": "0db46553-a7c9-44c9-bf48-779eafce794f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945010, "uuid": "7f7c1071-511c-4f3f-92e7-945b217214c4", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618945010, "uuid": "3fbe90b4-21e4-4f2b-ae11-fbcfe95b7769", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618945010, "uuid": "a2e985cb-c5e4-49bc-b479-2b13a1d83548", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945010, "uuid": "21e439ed-a5bc-48f9-a290-8e5ce37fd8e6", "value": "49141764e9ccfac2303707ec87b3efbb0a3e24ffb3cc237a174f21a9a74cc8da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de19106e-a22d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618960344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960344, "uuid": "8356f720-9229-4a03-9e80-19e964acf298", "comment": "Malware payload", "value": "ba545990ed323ab06254d9261048563f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960344, "uuid": "fd2ef6c6-c033-446c-981e-8af56c20b03d", "comment": "Malware payload", "value": "494b6265d22aeadd46c280b57ca03a5bbb676a0d3da9f689a6d17fa9794b2f6b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960344, "uuid": "98d8f0d8-7db9-4d71-a6c4-89df679f5d27", "comment": "Malware payload", "value": "d38bc6a3f939f4e16a6f34fd25fcd7039389b5f6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960344, "uuid": "b51655f9-6d0c-4486-a755-00f1baea389f", "comment": "Malware payload", "value": "56cb3a23bdbe2c8e06229427408d0055e51cc8e65644b01d1364760589783d99b73a5fdf0d279ec07e1d8eab8c704797", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960344, "uuid": "1514afc8-ac6d-4df2-b31b-3ffd798df8be", "value": "C9F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960344, "uuid": "eb14362d-e3b6-457f-8816-8d9001c7865d", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960344, "uuid": "45377f25-caa4-4982-8680-ac1689fe42aa", "value": "3072:uwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:uwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618960344, "uuid": "cf72ede5-9a71-4e5f-b567-714ba6c1a69d", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618960344, "uuid": "8e975667-27be-4da6-8486-d5fedaecfa9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960344, "uuid": "d0070f5d-7c76-43fa-92e0-4f285e5f272e", "value": "494b6265d22aeadd46c280b57ca03a5bbb676a0d3da9f689a6d17fa9794b2f6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd19685-a1e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618929450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929450, "uuid": "536fff27-d870-441b-a6e6-88a0124030ef", "comment": "Malware payload (Formbook)", "value": "95ad0de0d121d51993dc0e546f82772c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929450, "uuid": "280929a3-1988-4ed4-a989-ea886201194c", "comment": "Malware payload (Formbook)", "value": "494b892495fb6f002fd36477446bfc59f686fe73710d55dc782de8512452e535", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929450, "uuid": "706b7148-15ae-48f6-9ef6-6d85a0771b36", "comment": "Malware payload (Formbook)", "value": "e2830744f6497321e7b4c2a49d8270ea91b923c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929450, "uuid": "633ade80-22d9-4d31-b0fb-4584b226d3cc", "comment": "Malware payload (Formbook)", "value": "873642eb2522c71cc5d8d8e76e6d8de68ea1714b405eb5eb318963e807c50fb75b2d325295b25c328e3297b3ce68cc9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929450, "uuid": "9c7adb6a-4771-4641-948d-92b0775a6893", "value": "EBE4F13133A88664D8BE5B751421664123FABE66FB21D70D7DA8305D6F736C38312BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929450, "uuid": "536edc38-e934-49ab-a2ae-edb3f200475b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929450, "uuid": "3aba6ba7-4c9c-4ee7-a0dd-bedab3d59162", "value": "12288:5pHV+2+EVF4Cd0ix6ocmzL73KS6MapCmaZxzklPlEP+OcnVk19/EMnTfiJzRRRR6:Mil5rv7KaxYPlB/a9CRRRRR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618929450, "uuid": "d001ed84-8e84-4f8a-adb7-11e19b032d6c", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618929450, "uuid": "47735aa9-0a39-47d5-beca-6b280ab5bb32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929450, "uuid": "6c02f5d3-8e51-4dac-a2c7-13ebbf42ffc2", "value": "Invoice pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14eda93c-a21e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618953564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953564, "uuid": "91e30260-7772-418d-9c6e-ee93a7881654", "comment": "Malware payload (Dridex)", "value": "7e17c2078e6d3d47a7d22ada4b59265b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953564, "uuid": "46bb7f6e-5748-4c2c-b503-b943db9a0d81", "comment": "Malware payload (Dridex)", "value": "495673ba40b0f8aa36b07ae4bb3f8436cf506f54f22c9f2409f4d24631e3c7e5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953564, "uuid": "e1f789f0-54cc-454a-b487-5c6d1d5b47b6", "comment": "Malware payload (Dridex)", "value": "18bd86460c1dcb9475603b36ae6976fac8fa25e3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953564, "uuid": "36eee773-8f78-49fc-aacf-414551e2b24b", "comment": "Malware payload (Dridex)", "value": "872ab376884a5b2e4111be13ed2c16b55b8b3e1a9394e6d0b75724e162d4240948541aea1c6e6853d404e4f3ebd988e8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953564, "uuid": "3a83cade-1346-416b-981b-26a56e74c5b5", "value": "18F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953564, "uuid": "c5c69bd9-715c-4996-8747-78c48e92ef76", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953564, "uuid": "301aa987-6959-4108-a1ad-a1199290133b", "value": "3072:zwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:zwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618953564, "uuid": "6464967f-f91f-4517-af12-2f8a98df56ef", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618953564, "uuid": "3a2fd6bf-8aba-45ba-86a1-228d1682f55b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953564, "uuid": "1e336635-88f0-4ec0-a2c8-c4b8392bb3b2", "value": "495673ba40b0f8aa36b07ae4bb3f8436cf506f54f22c9f2409f4d24631e3c7e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822dbd1e-a21b-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1618952459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952459, "uuid": "e742701d-0131-4e46-95e4-73c1e585b461", "comment": "Malware payload (ArkeiStealer)", "value": "1dac307792e45851205962e1c6fde7af", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952459, "uuid": "51a8124f-ad3e-4e9f-ad31-053451dcf638", "comment": "Malware payload (ArkeiStealer)", "value": "498a439463d296db338fe3672714b56a8dbddd1864ff302d005fa451bf9a9c22", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952459, "uuid": "26ae6cb1-6246-4fe1-b5b6-9ebe5ddf92fa", "comment": "Malware payload (ArkeiStealer)", "value": "c49be84a3c3d491ab569b35659765ab70689110c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952459, "uuid": "93bcba12-c50b-4f38-a387-433373fe3fac", "comment": "Malware payload (ArkeiStealer)", "value": "fe0989a33004f657c42137d4b02f6a0da71ce2621e79c9e106a361d21487085f0f575ff48366eb5466067997c8cba507", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952459, "uuid": "4a81ce42-9952-4c0a-986f-a98137014b4d", "value": "C3C4F12136D0D076D167343189B8C7F65BBFB87116664A8F6FCA1A784F307E29B2530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952459, "uuid": "a66e7d1a-c3ae-465a-a058-558744281bc9", "value": "8f3b883f63bfc01a6dacbc74bf6f7699", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952459, "uuid": "2e3d6b98-336b-47d0-9b94-d7fd57b8e4a2", "value": "12288:QP9G5HHxhGGSskMQTtcC7p8gNa5CdVnc6oZOqK3XwD0wpfjqY/:QPAZRAGZkMe9XdVn6Oqm20Ijq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618952459, "uuid": "ddccd2ae-e4ce-4be5-af16-77d17b7b86d2", "value": 596480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618952459, "uuid": "eb6f6d51-1efd-43a1-b812-a5c09b22af5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952459, "uuid": "d5d1c2b2-0ae0-41fa-b650-c7b293a937f9", "value": "1DAC307792E45851205962E1C6FDE7AF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf06be3-a20f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618947296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947296, "uuid": "a18b6df7-f44e-4a39-8e8a-f1701d593b68", "comment": "Malware payload (Dridex)", "value": "add4361a8cdbf5c8766b28f56f4d790c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947296, "uuid": "6852ba32-787c-4b70-b96c-20d6448ce0df", "comment": "Malware payload (Dridex)", "value": "4995d087fc5c76553cc81726b0712925b8bdbffaf2aa1f852e0829ca72d589ca", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947296, "uuid": "bccbc982-36fd-461c-beac-9eaece8cca26", "comment": "Malware payload (Dridex)", "value": "d04c16def085d9092f521049764a1c6b5e3097ea", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947296, "uuid": "95b71207-95a9-4f16-b953-9b4beaf478a5", "comment": "Malware payload (Dridex)", "value": "3f653f29f9830d9909f1fdf4c8540e4ec3e57f600b5febab7c126a96dfc3569128f92a2eae3ec0a68e7bc73411a02e5b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947296, "uuid": "21cb9c6f-37fb-4270-a9a6-2d810da17752", "value": "61F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947296, "uuid": "8c4760cf-db49-4513-add1-0a573c1f703c", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947296, "uuid": "6d93124a-7a5d-4bcb-9bee-c91d130ffe1e", "value": "3072:FwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:FwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618947296, "uuid": "9b839fcf-516f-426a-a201-8f6725193716", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618947296, "uuid": "7f4be1be-ec54-4266-b973-dee870ad8499", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947296, "uuid": "614b3e38-df86-4aca-9498-428a4bc8b646", "value": "4995d087fc5c76553cc81726b0712925b8bdbffaf2aa1f852e0829ca72d589ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72a87a8-a213-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618949219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949219, "uuid": "66f65c9a-2210-4b75-b3b6-7c10cb6e0025", "comment": "Malware payload (Dridex)", "value": "f8450237730bc6302fda2d434197b4a7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949219, "uuid": "3590780a-c23e-4fff-bc29-6da68bffe2db", "comment": "Malware payload (Dridex)", "value": "49a2d8c03a6cd18361bcfa163e7b3fcca275be471eec22e470ecad7a52df2c22", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949219, "uuid": "d14cd3e4-2025-4b09-b7ef-bda50f5fc43c", "comment": "Malware payload (Dridex)", "value": "b79b46d4a9d82bee2ceaeb8bec55adc4aeb3139b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949219, "uuid": "d738ed4a-937a-445f-a324-328b90ee5e8b", "comment": "Malware payload (Dridex)", "value": "070ee5e681cc208ffd0718f355fbe143f7a1c1de3e74d54ea7b6cbc3c42f424a0f40800f39fb5bd7341a48b38d72bf00", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949219, "uuid": "7acaa5a9-5706-4f6c-abbb-532e4fcd135c", "value": "2DF3D081E78FF451E10A6DB59CB27A2B3E31BE481689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949219, "uuid": "73a2dd6f-239f-4af7-adde-7358c5db4918", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949219, "uuid": "cc8f0671-89b9-4007-a38e-ac45b1b08c19", "value": "3072:3wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:3wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618949219, "uuid": "f6915898-9cd8-4a1a-a689-b4a8b52331b2", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618949219, "uuid": "6c77d4c2-01e1-4c55-a9d6-74910a49c2d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949219, "uuid": "947de563-6390-492a-b9f2-177c8f29e946", "value": "49a2d8c03a6cd18361bcfa163e7b3fcca275be471eec22e470ecad7a52df2c22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b0f746-a212-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948546, "uuid": "d5b6bdf4-bf09-457b-9f98-3302f1a11548", "comment": "Malware payload (Dridex)", "value": "1ea9b70efddb79c255cd705a4ced9587", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948546, "uuid": "dbe49fe5-d94d-48d0-958d-d587a693b2b4", "comment": "Malware payload (Dridex)", "value": "49a68b230b93c1b03ca85d4be3540db9b5cd9bb45e935b30f2d22039050f4e1a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948546, "uuid": "26ed4e5a-5ee5-4023-906f-d9137a37e43b", "comment": "Malware payload (Dridex)", "value": "4048a70beca9f3db76b1ea649dbd40b7d9380f65", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948546, "uuid": "2cb814fc-3e99-492e-9d0a-a440205e2dc6", "comment": "Malware payload (Dridex)", "value": "d79a2a2acb98e0be62bc7eec9b6a227cc09dec6fea845cb9a5976f18066133cec00189c0fd1edd9b5686f5aeafbf333e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948546, "uuid": "1aa5984a-3c37-487f-a994-42753e271f46", "value": "B3F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948546, "uuid": "ab33b913-b7db-4dec-aa3b-ee3186e42743", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948546, "uuid": "a4aff39c-2388-4c9e-b1ae-b0d0091c8c6f", "value": "3072:QwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:QwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948546, "uuid": "35778e78-17f7-439e-a4df-37cfe0c9c2f1", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948546, "uuid": "c7466373-4fb2-4cbe-9259-b1244acb791a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948546, "uuid": "ef1b6433-159d-437b-a32a-93b372d2dede", "value": "49a68b230b93c1b03ca85d4be3540db9b5cd9bb45e935b30f2d22039050f4e1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02e0160-a222-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618955516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955516, "uuid": "4c56fe05-bc85-4d76-9e55-b32b16df7017", "comment": "Malware payload (Dridex)", "value": "a97231cded33b6e56342f242d54342d5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955516, "uuid": "2f7dbde1-ef3e-4bc6-a042-deff7c9197f7", "comment": "Malware payload (Dridex)", "value": "49c2b0f2c30fb7d5ae663272797ffe99e0501f17042ba627471907698035b62b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955516, "uuid": "8795fca9-c26a-456f-8f78-59593f9dfd79", "comment": "Malware payload (Dridex)", "value": "4e84f69de6e5dc6d7146a828f5393648d2b86e7d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955516, "uuid": "8a10a5c5-b853-4dc4-9631-11b04875bc81", "comment": "Malware payload (Dridex)", "value": "a38a0507d8ef9d395135277ebeb7121f9c2e81b149f48ad40721816c038fc435f065027a1558be8ffd932193f7ac9cb9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955516, "uuid": "79435b73-41a3-443d-8473-5f88bda9afcd", "value": "37F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955516, "uuid": "f553d1d3-0b18-475d-976c-c9c49993d798", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955516, "uuid": "29ee826f-80c1-4df5-8cbe-8490e622baa0", "value": "3072:mwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:mwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618955516, "uuid": "11213cf3-f2f6-4f49-b087-60306dc4b8ad", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618955516, "uuid": "dd40a797-5779-435b-983b-aab59f71d407", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955516, "uuid": "51c5684f-733b-4f60-b5fb-e47d228ad13b", "value": "49c2b0f2c30fb7d5ae663272797ffe99e0501f17042ba627471907698035b62b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d247a82b-a20f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618947440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947440, "uuid": "1fac82e6-7445-41b2-8d19-69a4cfb9a4ab", "comment": "Malware payload (Dridex)", "value": "d1740f36c5a82f693f95b5f494f855c2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947440, "uuid": "c59d0d71-eebd-4e68-8d91-518c025777be", "comment": "Malware payload (Dridex)", "value": "49d5fa269765c3aab7f31eb75cc753344c34dfd00665273109c08c2f34caea43", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947440, "uuid": "99d18b16-3985-4b52-8455-47484d6021b9", "comment": "Malware payload (Dridex)", "value": "1974eea35cba459e9ef0f89f08ad5b0057ee099a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947440, "uuid": "c1109f5e-7f7e-4fea-beae-c0a2599d6d3d", "comment": "Malware payload (Dridex)", "value": "070ff379b2386a4513af74f2c094b65b615d406e6b60570a327fcf6ce063792e91a1da6fcad067c8e0f8e085fc73a03f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947440, "uuid": "bccae49a-6960-4a93-b170-f85e99cd8113", "value": "55F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947440, "uuid": "29630460-def4-4ba5-9891-01bc23710280", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947440, "uuid": "7a334cfd-9d77-470a-815d-a0a988b9b8c1", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618947440, "uuid": "bc3ad664-824d-4237-acaa-c8693599b317", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618947440, "uuid": "d11d1a37-d069-4fce-94ee-42b38e739a2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947440, "uuid": "0fbcd44c-3fa9-42f9-9857-add216028e63", "value": "49d5fa269765c3aab7f31eb75cc753344c34dfd00665273109c08c2f34caea43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28648b0f-a1cc-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618918378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918378, "uuid": "7cccba67-7294-4ecb-a398-9c617a39665c", "comment": "Malware payload (AgentTesla)", "value": "a5dd8befce625f4928140e456e248e1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918378, "uuid": "9f57d24e-0e5d-440b-ab79-318de68637ec", "comment": "Malware payload (AgentTesla)", "value": "49dfecc9b9d122b59de9c748c4c86308d6666a707bcdefa910cf9be7780b68bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918378, "uuid": "1b1c9613-1c87-423f-b40e-08e860154659", "comment": "Malware payload (AgentTesla)", "value": "f7f745449a60aec3585a0be92ae47eb2d1f4ab79", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918378, "uuid": "0111d680-6240-4774-b509-45dce976d421", "comment": "Malware payload (AgentTesla)", "value": "f1eaf2769feb4af8c717408b1c8c649de6d4797da28e91626d69877ecd2c42e24f7e2ba05243838596b29cc94782a967", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918378, "uuid": "7f0733e7-21a4-4f3c-b617-356ff17e47bb", "value": "247413106661CC77E9EA08390AB3C32AC7D9507633C2555FEF10BA6EF6A07D22725793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918378, "uuid": "34fc2bdd-0568-4e22-9183-35ebf5410de7", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918378, "uuid": "6e02cf8b-573e-40cc-9613-10f7408d29c5", "value": "6144:2YYvG4SWcKnui9NM9saj0yMzQ8pS1PzyXLazuZ5rGp0PkQfClahqvtha:uABKuO1ajdAdS1OWMrGqICKha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618918378, "uuid": "cb2c7d41-6961-4a6e-85da-b72d9e281843", "value": 351613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618918378, "uuid": "6e26ab90-7da3-4f46-81b5-8f94e0bfe841", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918378, "uuid": "25ca3dfe-b82c-4aa5-b8e4-0cdcb17e87b2", "value": "334# ARD_QUOTATION (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee7e437-a207-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618943756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943756, "uuid": "f90b475b-a9ad-406f-9596-13812958869e", "comment": "Malware payload", "value": "7363ac95d298cdc5ca6ef6f67fa93719", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943756, "uuid": "bfabb9c2-1f3c-4a86-812c-514959d52b64", "comment": "Malware payload", "value": "49f3a34dd49bd76d69234da101c7c441b14a7651f175b2a1ca6fd35c03cef38d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943756, "uuid": "bddb9210-a9da-4435-8808-23e54c395fa6", "comment": "Malware payload", "value": "15045f21003d362a3c09718957437f49a3a9d513", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943756, "uuid": "4a52f037-f21d-4105-a506-a61868d245ac", "comment": "Malware payload", "value": "f50fe1d022df31f2ffadc8f2315ab46ab7791b1612e2f0cf4ceeb60b64286c25ab344e75120f247544c0eeee3d72c753", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943756, "uuid": "5c4a5782-3816-4eb2-b331-68eae475771d", "value": "31F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943756, "uuid": "c8276e96-01de-427d-acbf-b017f3a180e1", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943756, "uuid": "7e1ba22d-fcf9-437d-8305-2aafacefe99a", "value": "3072:0wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:0wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618943756, "uuid": "904ef88c-fb8b-4731-9a0a-79b0df7f3088", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618943756, "uuid": "60c132dd-6c27-40b4-b093-f27b5cc31a28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943756, "uuid": "9d494c8e-fc5f-4217-bdcd-91e7dfee1bec", "value": "49f3a34dd49bd76d69234da101c7c441b14a7651f175b2a1ca6fd35c03cef38d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71fb3480-a185-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618888007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618888007, "uuid": "a4cea49f-82a9-4374-ad77-e65c20348b70", "comment": "Malware payload (Dridex)", "value": "88c8432cc73d3cdce0122db2cf571410", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618888007, "uuid": "37a965af-fdbc-4050-95c3-62fd157098de", "comment": "Malware payload (Dridex)", "value": "49f52aeaba28dfa228bd6c1d584df7ddc344c87254053cac6f91e30f99966bbb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618888007, "uuid": "80797728-1540-4f40-8e71-6ed5bcdfc988", "comment": "Malware payload (Dridex)", "value": "07a508c4f4ba602e9da6c7aa0e3abac7d4a2240c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618888007, "uuid": "dcaf30f9-e23d-4572-b082-1bcafa685ae1", "comment": "Malware payload (Dridex)", "value": "4064572cc640f92ed7d8675a29c3eef7e883575b208abbed93420b8c5c303aa1e10454e8edf9b050e96d56d56411ea11", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618888007, "uuid": "cb81f501-9c76-40c8-9b7e-261e8f945486", "value": "45F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618888007, "uuid": "5bb14197-1fdb-4955-9392-8934c1f22f3f", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618888007, "uuid": "641d8eef-e9f5-41df-977d-43d3b0616fdc", "value": "3072:9wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:9wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618888007, "uuid": "f45a6a63-6abb-41e0-af9f-dd00787f5b29", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618888007, "uuid": "7e04eb7e-ae08-44bc-87f0-16a527e7d30c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618888007, "uuid": "df6ec829-ae30-4036-aa6d-5c336078f3b5", "value": "49f52aeaba28dfa228bd6c1d584df7ddc344c87254053cac6f91e30f99966bbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f700ae-a232-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618962315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962315, "uuid": "11187da0-3c7b-4435-8ac1-d91b55e28b45", "comment": "Malware payload", "value": "9dc7ba207dfb7d62654f63f747679d09", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962315, "uuid": "5fb65606-cca9-47a3-bb8a-6d1196b05ad8", "comment": "Malware payload", "value": "4a0c9b8a16ba57ea0b0842fa6a4a8fb1feda3b815890d2f17965ac9f2386d2ac", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962315, "uuid": "6e0cb0de-95a7-498d-b41f-94bf54d251d2", "comment": "Malware payload", "value": "ae87a250020e9392d9c5387e80cba3b44db72bbb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962315, "uuid": "8cb9de60-d10f-4a77-a271-40c32c2a8b46", "comment": "Malware payload", "value": "a3cb1a83e16e31e847500fc1e094046e2a5331346596f156243dc747ece9b01408fd175af2b3d278b04e9054c7436d6e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962315, "uuid": "8613a676-bb30-4da6-9605-21dd96c1b8ac", "value": "ADF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962315, "uuid": "dc9d9faa-8461-4a2e-9c76-6f04d1e91d45", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962315, "uuid": "66606af1-d04d-4bd7-ba54-1fb5412fc4ac", "value": "3072:XwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:XwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618962315, "uuid": "6fd5eeef-8829-4555-96df-625526e0a59e", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618962315, "uuid": "7d879a1f-9d37-4193-9bff-7ec76c7f9974", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962315, "uuid": "f99b8ec2-e9a2-44e9-bc7d-e0ffd9ebf60a", "value": "4a0c9b8a16ba57ea0b0842fa6a4a8fb1feda3b815890d2f17965ac9f2386d2ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7c156e-a197-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618895780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618895780, "uuid": "c4b690e0-25b5-4dea-8fbe-cd42152227e5", "comment": "Malware payload", "value": "ea03fdae5e3ca3bb0cc0b17a4f98ab14", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618895780, "uuid": "d4301a40-8206-4e9c-b268-45936ae1f4b8", "comment": "Malware payload", "value": "4a1e3a51548e069c5a8a565f9032bee4089c05cff045c7af5e1e4466ee4e707b", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618895780, "uuid": "db4c9ea1-c7bd-4a52-9a2b-43a66e56dbcf", "comment": "Malware payload", "value": "53aa45b8a04090014247185939ea13839cf299d9", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618895780, "uuid": "dedddb59-a9a5-4938-a140-31b4220d84eb", "comment": "Malware payload", "value": "fe1d79bf9541fb72ddfa313e32ea322e9fd5d77b211ce40680dcd1f57e2cd5c47b007da19acdb791eb40878f9ce7d81f", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618895780, "uuid": "25c5a335-09b1-4ae8-af75-031717946efa", "value": "83A4F16232D1C032E1631831DDA9C7B1A9B8F9385975854EBBD10B7D6F21BE2C726B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618895780, "uuid": "12c35f72-7042-4afd-ba9a-985b8d3a7fe8", "value": "130312efe8892496180179ce46d20b79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618895780, "uuid": "f16e3c4a-6473-483e-adfd-9b3c146f5805", "value": "6144:nACTD4Pbn3f+yfwKIW+fcfzO/LimEPJ91FtmpOdEiE5C+lcq/jOU3f8dpkYH:n3TD4DnRfwKl+kqL4PApoE9uqf30HkYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618895780, "uuid": "57b2c6df-c963-4cdb-b839-a5d52be48adb", "value": 457111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618895780, "uuid": "0a3b4a38-0af6-4cc1-8e4c-65b0912f82e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618895780, "uuid": "c3dcbfdf-e6dc-4468-bfd3-5209325b6892", "value": "Statement Of Account-35T726.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba92024-a220-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618954730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954730, "uuid": "6c0df219-e344-4619-9445-b57da50a5f6c", "comment": "Malware payload (Dridex)", "value": "b7534e123fa1187577435c16afd87a4b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954730, "uuid": "f8bf4a96-d337-4cbe-8bee-4217762a4755", "comment": "Malware payload (Dridex)", "value": "4a48a9f2eb78a9a68076b2748821bce15973dc0dc450869c4b88f725063c2504", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954730, "uuid": "f30c506b-cf72-46a8-ae75-84f95fd1efe4", "comment": "Malware payload (Dridex)", "value": "44de6dbe25464059c30c8120349ef1cc28b1b568", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954730, "uuid": "09e93e01-79c6-462e-a079-6821a60c32c7", "comment": "Malware payload (Dridex)", "value": "1b4032dd79aa25066699099235c19cee8c19c309beef5271271207931fed2c33ad9c219059372dc617fab8c039f35663", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954730, "uuid": "0ca58b22-be5d-4ea5-8323-bdf2f65fd76e", "value": "C9F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954730, "uuid": "8eb6883f-507b-426e-8084-478bfeb395b9", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954730, "uuid": "d02ea3d9-3e8c-4d08-81fc-4250c6c9b79f", "value": "3072:AWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:A42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618954730, "uuid": "f8eaf885-7dae-4bbd-a7e5-19b08bf3a51b", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618954730, "uuid": "383c8c04-812f-4efc-a0b9-b492faca3cca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954730, "uuid": "0d136818-2d95-4e79-b9dd-cc1a20eaba51", "value": "4a48a9f2eb78a9a68076b2748821bce15973dc0dc450869c4b88f725063c2504", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec448c82-a20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618946624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946624, "uuid": "d4204131-3750-41bf-bf44-0845f5c005c6", "comment": "Malware payload (Dridex)", "value": "a6edac1ee5bc23c85f33f456825449b4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946624, "uuid": "73277b1d-2c3b-4811-a592-e10bd36d4c1a", "comment": "Malware payload (Dridex)", "value": "4a672cbc77cf510f3d0a52d232f7f3f53dabf96d6d501cf178dc5c068aa6a944", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946624, "uuid": "0f26f2da-45c0-4f58-9d99-72a915eb0f52", "comment": "Malware payload (Dridex)", "value": "7a342a3c3154d163dc1bd51435d9ccc0d7c6cebe", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946624, "uuid": "64816489-4699-4887-b03d-01def4bd4e20", "comment": "Malware payload (Dridex)", "value": "83b3704e628e4b6194044c092390988ba30545485a6e81b61138ddc6eafdce5459396d886a5f7e67ceff181ff95aa379", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946624, "uuid": "559fc9d6-19a6-4a22-b8ea-51bc018ab340", "value": "37F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946624, "uuid": "65107e97-e08c-45fc-b172-55c5e403dd4f", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946624, "uuid": "5defd2a3-f2f6-4e85-9a11-a5971bfabab8", "value": "3072:6wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:6wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618946624, "uuid": "5eec659d-2ddc-4f55-89dc-83718ca15df5", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618946624, "uuid": "d4cd39b5-db28-42e4-982c-dc019369f0fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946624, "uuid": "8edba0ad-7bda-43ff-a48e-90c338f92173", "value": "4a672cbc77cf510f3d0a52d232f7f3f53dabf96d6d501cf178dc5c068aa6a944", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc97362-a215-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618949927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949927, "uuid": "7f82ae65-dc49-4f15-a486-40027cff2b3e", "comment": "Malware payload (AgentTesla)", "value": "92b3592c5d8d1637aa36701a52ed60a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949927, "uuid": "0df09459-649d-46f0-aedf-2dd1d1dd1055", "comment": "Malware payload (AgentTesla)", "value": "4a6f5cd0562d515f27aace0fa5029f6408d6f712c627404df22bf34dc3408302", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949927, "uuid": "cd3035d4-73c8-48b6-b3ad-17964c0870fa", "comment": "Malware payload (AgentTesla)", "value": "789b220f62b8680e9b0157293ce8219a113bda2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949927, "uuid": "79ee35fd-34ac-4009-b299-7e645bc5b6eb", "comment": "Malware payload (AgentTesla)", "value": "7fccc5756caa13a2ff610f85b9983bbc851ad2d85488f75720a582a9965b52e11a24cd0c80d34d5cc12763847d1f28e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949927, "uuid": "bd6377fe-cae6-4e22-a6a2-d4e22da49abe", "value": "82F4231303A2A646C22E230F478E3A22556D4B7C36E45AE7D4751B79FA2E05D2DFDE0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949927, "uuid": "d7ea4aeb-215e-485c-9ab7-b2ddb70b6c41", "value": "12288:4l1ANTfDO+gRjlpIoob0p2NsUYJXJ5KjVuws/1nL8q7ATGHbl2PK+dB+1IQnETC7:4c1LOBplpAnNsjXJ5K8wS1L3ECydBKEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618949927, "uuid": "63914c91-d314-4d95-93fe-60a14c5e6395", "value": 723149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618949927, "uuid": "c2baa12a-e98e-491f-8d25-634c251b64c8", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949927, "uuid": "4b297480-ee25-4544-9425-2e5a654c9a11", "value": "Outstanding Statement-0413.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d91738-a16c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618877355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877355, "uuid": "226ae13d-8269-4021-9d3b-ab2f83864887", "comment": "Malware payload (Dridex)", "value": "15f9ac3086ee19ca1e6b9d41c6530bd6", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877355, "uuid": "49c7f339-7da1-4882-9ec5-0f665c1b379b", "comment": "Malware payload (Dridex)", "value": "4a91e023f1f34880db08ae3cd319edad3916bdbee3e9075a280113f87cd339af", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877355, "uuid": "7e6c4db1-2306-4f45-b0a5-f9c028a74c84", "comment": "Malware payload (Dridex)", "value": "f3b999fd4d26faa02166f2b3a03869f55a402d70", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877355, "uuid": "bc70670d-641a-4ca1-afec-34db2255271e", "comment": "Malware payload (Dridex)", "value": "6bb52e1ff8bddc4a82ecaeebd32c758df44db4411e5b2d088136f0b956182f581b21499c80fc6127bd8f2316717e9ac7", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877355, "uuid": "3ceb0262-0e30-4c84-b342-7dcd806a23f3", "value": "87F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877355, "uuid": "fb99a497-5b1b-4d16-b7a7-d58e54a0ed47", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877355, "uuid": "ce7ef5ae-9307-435f-85d4-42e80a9f18df", "value": "3072:8WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:842IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618877355, "uuid": "56e0b3c9-11ab-4110-b55b-a28e6578330f", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618877355, "uuid": "63932b07-3af6-4b75-bbea-9984aeec8b5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877355, "uuid": "6e2cf2aa-ff3a-4e24-badb-2b4b73c3ac0f", "value": "4a91e023f1f34880db08ae3cd319edad3916bdbee3e9075a280113f87cd339af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd3ec72-a227-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618957550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957550, "uuid": "3512e5a7-cd90-49fd-a5ac-d08be91d1ccc", "comment": "Malware payload", "value": "cb7ce26da8553209720f558887dd94a2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957550, "uuid": "4d62c0ac-e14d-429d-a7ca-311cd29a6037", "comment": "Malware payload", "value": "4a92e7003e56958f2da45a32d899e322364f7f7b22d62639ebf5dd3174bdd551", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957550, "uuid": "d2080e76-36ac-4456-987f-7960e1468661", "comment": "Malware payload", "value": "bf480c8952b949866883f2235b95ffe4c7e45263", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618957550, "uuid": "12e9abf3-b2bf-4c26-87b7-f693913ece70", "comment": "Malware payload", "value": "d1a00ee5ac2c16244f8c07f42e127426ac54906502515c580aaae6db8313f8b7e18e220d8837267e9dfa9568a0802055", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957550, "uuid": "8387a612-af69-4c09-b7a6-052db647e83a", "value": "1EF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957550, "uuid": "23ac2fa5-e983-4d00-9b19-5d45f0cc9ae2", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957550, "uuid": "bc71c67e-7b39-4a5a-8513-e88abbdb31d5", "value": "3072:cwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:cwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618957550, "uuid": "7ebb0c53-1016-4dab-890c-04623a2dbb9f", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618957550, "uuid": "778284d1-096d-4253-9ab1-76e1a5ebb207", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618957550, "uuid": "cbedce7f-d7ee-42c8-aa77-f88b4ce977a5", "value": "4a92e7003e56958f2da45a32d899e322364f7f7b22d62639ebf5dd3174bdd551", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ccdfb2-a218-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618951308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951308, "uuid": "c255b161-7b69-4986-8b7b-fcfd140e567a", "comment": "Malware payload", "value": "4575eb8ed01ec897061c868d0b3247a2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951308, "uuid": "dba0d59d-b01a-4686-b105-c4d6edfdccc8", "comment": "Malware payload", "value": "4aa9e9db78cd563aab674aec1c371f4f45d57b4716067c183544d105dbd8c3f8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951308, "uuid": "5fb3b11e-a26d-47d0-b9e8-d46776a85ac9", "comment": "Malware payload", "value": "d523fc1c7ed364c73615cbf20ae2d2e1065a8795", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951308, "uuid": "9f020169-96ea-44d4-bb9c-34c1e8437949", "comment": "Malware payload", "value": "0e4b316a1d2821b6d1c22158cb50b787b879cdebd84b1fb7313b0cef8c1fce29949013fb0b91c4556e064cf0a41be5df", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951308, "uuid": "03e18ae4-fc4a-4948-924f-bbc591b8593f", "value": "CEE3017EC93BB565E5DB113A97191B13ED8B104D67D0A989CE0BA29C0453DCF2E118CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951308, "uuid": "dd3fb1be-6297-4975-bd63-d327940acdf9", "value": "3072:/vM/sgHSbvdSq4t8feqZ+mfr3bh3KXzf7XY37RzNV5l8cgALg8EGr:/vM/suGSaf/hDdKXzfYDVzgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618951308, "uuid": "7e1d089b-ba7c-48bc-b487-cd5362b34ca8", "value": 144411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618951308, "uuid": "cc187caf-37e4-4cb5-9b14-b1eb13555e54", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951308, "uuid": "7bce085d-6ce1-40db-85db-d99ea7bdd92b", "value": "die Fakten-04.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7817296-a18b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618890808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618890808, "uuid": "f98c6b48-12e0-4446-87da-f8196377d17b", "comment": "Malware payload (Dridex)", "value": "00910ab288d1c74d601e1af9a2866f02", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618890808, "uuid": "148be431-792b-4802-8158-eb268c35fbeb", "comment": "Malware payload (Dridex)", "value": "4ae2cc69ee016ac966132f100c7292ee21b3efdc87d44bf8ea80985883dca21b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618890808, "uuid": "5e92fb40-354f-4319-bee3-bc1b749184d6", "comment": "Malware payload (Dridex)", "value": "95ced031e24945e6b36fd56860662d00202120a6", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618890808, "uuid": "8ae2d0ac-d0d6-4e6e-8723-fd458e86eac8", "comment": "Malware payload (Dridex)", "value": "a4fe292f6214c242121e8827f07344e3718af98440f7a42dcb8c91832e775c45dff1e8ea16497094a742a72976b4875c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618890808, "uuid": "dbc7bfb0-60db-4863-b175-039862b24c18", "value": "4EF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618890808, "uuid": "bb0cf294-2a6f-4dc1-a28d-1d924e1de1c9", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618890808, "uuid": "4ad7ca26-e1b4-4351-85d9-962a455f0f29", "value": "3072:Dlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Dlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618890808, "uuid": "aa565d44-0c1b-4c9a-84ce-3d70d10c5111", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618890808, "uuid": "299d8442-a4a1-475b-aa7b-d5b9a408c973", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618890808, "uuid": "e60d5224-4d10-45f6-bc36-0dd228109d9b", "value": "4ae2cc69ee016ac966132f100c7292ee21b3efdc87d44bf8ea80985883dca21b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a47807-a219-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618951603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951603, "uuid": "0e020ab9-bd52-4caa-9acb-7c6c60a3965b", "comment": "Malware payload (Dridex)", "value": "a2a681f01e2d04134902170f1c8b41b8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951603, "uuid": "ffabe3fb-d88f-4d7c-91ed-27a5b8a5a4a9", "comment": "Malware payload (Dridex)", "value": "4ae49d301856512a57f368bfae48c3d4acd7a737b48e4a3a31c16c764a6127b7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951603, "uuid": "29aab366-489c-4595-beb7-60ffcef9b478", "comment": "Malware payload (Dridex)", "value": "6b47edb215dc582998e93962f2621f423e5744e9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951603, "uuid": "29126083-0826-44d9-95e2-2e1e36a1b73b", "comment": "Malware payload (Dridex)", "value": "6b2ff8a1ae725b5072145ef5131fa898c0848c65f5a82ddf34fed5df731e0ed5555a0d6b7f2d5ad5f8b8ef4e4be65c8d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951603, "uuid": "bde5d347-07f2-4442-b73c-e775eed39da1", "value": "67F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951603, "uuid": "af1b1bc1-6f1e-4e5c-bb05-25c65be3a3f3", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951603, "uuid": "35182b82-b2ff-44c1-89cb-84c985a36926", "value": "3072:qwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:qwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618951603, "uuid": "802e5098-a720-4678-8ad8-dd73ff1006f5", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618951603, "uuid": "58a51f16-db6c-48ed-8f9d-1cf899853ef2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951603, "uuid": "1da9afcd-8343-4125-9b4f-aec7c48ae3df", "value": "4ae49d301856512a57f368bfae48c3d4acd7a737b48e4a3a31c16c764a6127b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64a1f53-a214-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618949648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949648, "uuid": "d65320e8-179d-4390-a039-908edbbc3463", "comment": "Malware payload (Dridex)", "value": "7300d6e48a9bc9023665bdf4131d7527", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949648, "uuid": "9c32f497-7389-4942-9139-2dc9cdfaec01", "comment": "Malware payload (Dridex)", "value": "4aeb1472dfea957b6f95814e80bf1d2364c313f39979f8cc3978e822beb394f4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949648, "uuid": "4debe740-c8a4-4dfc-ab75-f1889fc4dbcd", "comment": "Malware payload (Dridex)", "value": "819098fd7a8ca008b10fd993ce56d0f13bd47218", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949648, "uuid": "2a31f513-e797-4705-939a-550f60d80fc4", "comment": "Malware payload (Dridex)", "value": "0059b364df667e00b50a2237cb6f0bbdc021aaed402473fa9eb7e7c5fc3b6acb16ae3e785591b7052bd24855ab49a5a8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949648, "uuid": "3e47a1c6-1046-4e54-a330-33bc0a731a75", "value": "F7F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949648, "uuid": "34b445e7-fed9-4f7a-8722-d11bf0a134fa", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949648, "uuid": "4d8ffb78-0740-4f39-9d72-f1420d4aad9a", "value": "3072:+wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:+wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618949648, "uuid": "43a5a53e-9224-4c92-b95c-b0184b268fa7", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618949648, "uuid": "41647de2-2c19-4ac3-be45-ae004bf1e5e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949648, "uuid": "67f00bd4-0de3-4e00-9a8b-50014ba2bd69", "value": "4aeb1472dfea957b6f95814e80bf1d2364c313f39979f8cc3978e822beb394f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa02dded-a211-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948231, "uuid": "d8182dcb-27de-485d-9e73-1121dd48e775", "comment": "Malware payload (Dridex)", "value": "48907fe79ee49f5729564a9adb7b8e01", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948231, "uuid": "010b60a5-3d77-4521-9c0f-cd19a8be9427", "comment": "Malware payload (Dridex)", "value": "4aff026bb6bf27259e89e620f348e192d55dce4068057fd058ef64fbd46e1aa7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948231, "uuid": "49f2bf2d-0514-4a34-9170-7ec17516cec4", "comment": "Malware payload (Dridex)", "value": "d4b22b9f7a4a9a8ebc1de5e3f99dc177e987c8fb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948231, "uuid": "0fb95234-91cb-43cb-b77e-cb8d4f1d1002", "comment": "Malware payload (Dridex)", "value": "a122c678379389440e4b0a5074ce8992f692c39ed9236b1a27bd37c76770f5e12ca6c72c7819555361937ffc9c35dcc3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948231, "uuid": "7fb2a872-8ac5-48b8-a1ac-7ed949ce3360", "value": "9EF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948231, "uuid": "bcd5c205-2aac-4d59-8028-4ec06d40ef09", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948231, "uuid": "4a17ca1d-1de7-49d0-93aa-dd051e3f00e2", "value": "3072:PwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:PwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948231, "uuid": "d021a967-f469-44d2-98b9-9ded7f9587e2", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948231, "uuid": "cd60ba88-08d2-468f-9753-81c704efbde3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948231, "uuid": "d6056d71-0a29-42a3-8ff3-81243a496442", "value": "4aff026bb6bf27259e89e620f348e192d55dce4068057fd058ef64fbd46e1aa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2be6927-a1aa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618904034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618904034, "uuid": "faf8311e-09f1-4dd1-8293-fa5b0f14a7a4", "comment": "Malware payload (Dridex)", "value": "33cf4a324a3802194725029d5b9eb537", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618904034, "uuid": "0ae02af8-91de-4b65-a5a2-59e629d11081", "comment": "Malware payload (Dridex)", "value": "4b030d8ecbf8e4b0d57d932e95f47a4334486f788a5c5e47eb698a5392f61c2e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618904034, "uuid": "dc42d5c4-0ca5-4e8a-99c8-3ee145b238b4", "comment": "Malware payload (Dridex)", "value": "94a00a79e8642df4db1c882105368baf96af2c82", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618904034, "uuid": "33b68b89-da63-4851-99df-1b44cad6b933", "comment": "Malware payload (Dridex)", "value": "972f449add474d4c208a42cd09a49cde0c75799ff5e699e6caf54ea1c50b3efd8e98f57d52507cbe7ae3176102820bc6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618904034, "uuid": "bcd9ce02-1a39-46a8-a66c-06304807a656", "value": "4AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618904034, "uuid": "5f08110f-16bc-48f6-9d35-b97d2c460fe6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618904034, "uuid": "6c6e2776-0b62-408c-8af5-413f5d598fc7", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618904034, "uuid": "c7e8af1d-1b4b-4c7d-b33f-c09396ea680c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618904034, "uuid": "71bb849a-0c72-46f8-b8a0-b6be8f548796", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618904034, "uuid": "bebb0c1e-eb0b-4544-bb48-b164caf5e8cb", "value": "4b030d8ecbf8e4b0d57d932e95f47a4334486f788a5c5e47eb698a5392f61c2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd613e8f-a21d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618953525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953525, "uuid": "b0ff7514-924a-426a-9789-8db09cfd8c2f", "comment": "Malware payload (Dridex)", "value": "3b2c092e323437345f3492cf056c44cc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953525, "uuid": "1415e7ba-9f3c-47a4-a364-e722f56d0726", "comment": "Malware payload (Dridex)", "value": "4b3c7e685ae0741ce0184982c78d69d98902a28ebb5fc7d5fec51361161d9658", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953525, "uuid": "b1dee6f2-8499-4e20-8e78-ef05c12be86a", "comment": "Malware payload (Dridex)", "value": "0905983ae7ea5c7b9b696331b07861f22ba65a9e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953525, "uuid": "eaa01b78-c5b0-452d-9291-c874a6f04346", "comment": "Malware payload (Dridex)", "value": "6f189626638731465c19466696640f67df5723def4476caee454a344863dd5404f2c5c6635fb8fb36164ee68005ce36d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953525, "uuid": "b35d9b8d-8036-4b02-b878-bdaa95d99169", "value": "9FF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953525, "uuid": "6a6f0de0-7244-4673-a716-aa7e5cf33f79", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953525, "uuid": "c0840fe1-5b5a-4c10-a790-cb26d917adf1", "value": "3072:VwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:VwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618953525, "uuid": "6d95b1ba-4aca-4223-876b-75e2c58f5163", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618953525, "uuid": "8edbfa50-fca4-4ce7-a1b7-5266ac88b924", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953525, "uuid": "d7b09f75-f7db-4b38-be23-2d3641113653", "value": "4b3c7e685ae0741ce0184982c78d69d98902a28ebb5fc7d5fec51361161d9658", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88d06a6-a1ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618932391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618932391, "uuid": "96c4d4b3-755c-4ee8-808d-eed272582249", "comment": "Malware payload (Dridex)", "value": "7b8d4d21b6d52c269638b707f731126d", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618932391, "uuid": "a6f9f2f1-17ba-4722-bcf3-90e23421f9a0", "comment": "Malware payload (Dridex)", "value": "4b76f77251e8be08aa00ddfda6a105ad31e6c75afd5892636ba638541d605ab5", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618932391, "uuid": "8a6fc089-d1aa-4617-9fd9-90aa0bf79c04", "comment": "Malware payload (Dridex)", "value": "e2bf8565de32dd8a9574303924a7810c28544eeb", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618932391, "uuid": "574fb493-7d73-4ef2-91d8-b2fb7d3c32af", "comment": "Malware payload (Dridex)", "value": "97016335ff3ab2d6074a71260d67620449e69473d0331c2f565bbab15896534dae1ed6ad60146c13e607a2b145e7ba63", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618932391, "uuid": "cfca6cc0-9760-4f63-b182-b875890b6b3f", "value": "E1F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618932391, "uuid": "7e8a6f3b-4b9b-4ed2-b476-415c47fe7b55", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618932391, "uuid": "b469b4b3-dd84-4ee8-95dc-a5065496f40e", "value": "3072:xlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:xlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618932391, "uuid": "16c3ef94-6952-40af-b0e6-bd2ee167f5d8", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618932391, "uuid": "00534650-a840-4b64-ab1d-dc339732f16d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618932391, "uuid": "3205cd82-fb60-45da-af9d-d55f6cc5c8c0", "value": "4b76f77251e8be08aa00ddfda6a105ad31e6c75afd5892636ba638541d605ab5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58f6de2-a1de-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618926373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618926373, "uuid": "f7c36c73-b598-4943-bedf-20beae23f141", "comment": "Malware payload (Dridex)", "value": "8f35946f18911f1cb9fa3258e6a46807", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618926373, "uuid": "f645530d-8776-48cf-b22a-9f17e8510097", "comment": "Malware payload (Dridex)", "value": "4ba279116e89695128ca1690b7752db58a24d3b63597146cadc5770e5131f19e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618926373, "uuid": "661263b4-ce31-4007-acb4-4b04c0cac44f", "comment": "Malware payload (Dridex)", "value": "8953bd356f2a0421b12803ecf3379bad9fc0e2bd", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618926373, "uuid": "0aa66f8e-a984-4025-891c-ae1b0307f948", "comment": "Malware payload (Dridex)", "value": "91e64ab3d820c58b200ed7310f320584d74dddf9b903f52bdd80010fc897d4329126fbf9a873b99b03322149157d6c44", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618926373, "uuid": "f58f2c26-b757-4642-a18f-1aa5069f432e", "value": "39F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618926373, "uuid": "96e00bb0-e48d-40fe-8b09-aec6d5e9ddd7", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618926373, "uuid": "e350e695-a49c-4e7c-9ff3-e45eed4c125d", "value": "3072:5WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:542IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618926373, "uuid": "073c00cb-d7f0-462d-95b8-cc0def63ebed", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618926373, "uuid": "86fdc169-a789-45a3-b13f-d574ed4727fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618926373, "uuid": "51e13e69-bb7c-41bc-8dbf-93169a48bb68", "value": "4ba279116e89695128ca1690b7752db58a24d3b63597146cadc5770e5131f19e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c78c052f-a1fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618939691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939691, "uuid": "28583e6b-a2f1-49c8-99d7-6dec595af348", "comment": "Malware payload (Dridex)", "value": "db3d4aef13b9891b121c07dc8b9903eb", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939691, "uuid": "1c7224d3-8afc-4048-b4d0-80ad5e1a7d4b", "comment": "Malware payload (Dridex)", "value": "4bae380208f8d01583759e3581b1a6dfe2fb08eb551fae48a5022b95c3c6fad2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939691, "uuid": "74b3555a-df41-4102-9332-864c5c75f25b", "comment": "Malware payload (Dridex)", "value": "21660c8c5009d94b605ea7493a6806c6b3a99a12", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939691, "uuid": "44d7ff85-9feb-4790-ac97-d4d9b9fd1dec", "comment": "Malware payload (Dridex)", "value": "c7217e9da050efbb31f7e548857bfa4af6ca8ec3ab2556f1575a3994ba7c15bf1c5a719e4514fda0d5c39fc28ddce342", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939691, "uuid": "582d27b9-7e06-4906-9c96-e006e55acf91", "value": "35F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939691, "uuid": "53c88214-43ea-4280-b7f0-e8ff05ac935b", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939691, "uuid": "9142356f-7332-4df6-91f9-f29b06bdf2fe", "value": "3072:6wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:6wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618939691, "uuid": "ef26fb0e-302c-4b53-96cc-99fa40c31d5b", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618939691, "uuid": "999abd86-4d24-440e-a699-557947edd283", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939691, "uuid": "ceeddc52-1aad-4590-95bb-1fc74d2f97d9", "value": "4bae380208f8d01583759e3581b1a6dfe2fb08eb551fae48a5022b95c3c6fad2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c41f57-a22b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618959196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959196, "uuid": "b5ad265c-b101-4944-b46b-75b652861f94", "comment": "Malware payload", "value": "4736e679502ab9c4abafb82a9606139e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959196, "uuid": "d1785859-9257-412b-a239-ba584237c704", "comment": "Malware payload", "value": "4bb4b8766abded75bff028e5fa55a1fd9ef7bed399122d44edce6cb04fabf851", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959196, "uuid": "3c60acf7-4d35-4a2e-91ce-fc121f27bd89", "comment": "Malware payload", "value": "892b21f55c35d004c87795e0b8c8008f6da60727", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959196, "uuid": "c562c8f4-f82f-4b94-bb45-cf2a11601c54", "comment": "Malware payload", "value": "5a2bbe0755b62617064eaa0b38a12644948574846a677a352a134ebdd5a178d998b77c4dc093b8c743e260a1f1498a8a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959196, "uuid": "fd3a6ac0-dcc9-4a15-8cad-89a67eb22c0b", "value": "8FF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959196, "uuid": "5ccb2af2-711e-4ec2-b936-6dc523e96302", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959196, "uuid": "b356a388-50d8-4b34-8c0f-ccb4c7dff98a", "value": "3072:0wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:0wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618959196, "uuid": "918f13ef-854c-42e9-8ce7-d65fec8aa949", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618959196, "uuid": "0b868964-6679-43f9-a801-82501a77134f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959196, "uuid": "8eeb2bc2-67d2-4c9c-a22c-83e49f350c3f", "value": "4bb4b8766abded75bff028e5fa55a1fd9ef7bed399122d44edce6cb04fabf851", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "680dcaab-a1d5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618922351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618922351, "uuid": "af931533-4bed-412e-9747-df18691db91c", "comment": "Malware payload (Dridex)", "value": "b23cff2d86d77ff931c8dd35a6ee3982", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618922351, "uuid": "c7e91574-f67a-46b9-bb20-77ff4755d044", "comment": "Malware payload (Dridex)", "value": "4bdb7a7c1d264b18c6dc625b8c1d2d4c228a67f1ca0db70f37e4387419d1ede2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618922351, "uuid": "353e09ec-2ead-44ac-9c4a-771b5b7ce676", "comment": "Malware payload (Dridex)", "value": "35021885b45e9557b83409bce4f3658c56e95295", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618922351, "uuid": "f9b3921c-5c4e-4dd0-9c8d-72042b063f6f", "comment": "Malware payload (Dridex)", "value": "fb3e2ba9da2f62d931e580f694f38e8eebf6569a758dc4e221b23610f9bb1bc491ad6a63c360ca008d57e75eda94393e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618922351, "uuid": "91ff15a5-3945-4c34-bbae-aae9d7d3dd52", "value": "F9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618922351, "uuid": "914b08ae-1a5d-424f-a3f8-758f5d556702", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618922351, "uuid": "91242b7d-7cde-4821-8425-35609713b396", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618922351, "uuid": "3f53d1c8-6e88-4141-b273-ef7f58ba8e26", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618922351, "uuid": "d934238f-49a3-4472-ae09-bc24faecc7f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618922351, "uuid": "d47382a8-40d1-4799-9994-1dcc818834b3", "value": "4bdb7a7c1d264b18c6dc625b8c1d2d4c228a67f1ca0db70f37e4387419d1ede2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747aff31-a20b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618945564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945564, "uuid": "4b067ff0-813c-4900-b023-a9c4f8ad0c7d", "comment": "Malware payload (Dridex)", "value": "156a62fbedaec7e39ba928fe2163f373", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945564, "uuid": "752f49c9-459b-41d5-8890-77b8b16b2933", "comment": "Malware payload (Dridex)", "value": "4c151865de15e3ee7b028b8e27540b0c3eea99adb54db2756250c4133ffff7f5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945564, "uuid": "b4320cde-4563-4503-ac4c-2b9565eeafa7", "comment": "Malware payload (Dridex)", "value": "e7cad34f3e9755c6b8655537f767c3d0ec5d19c4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945564, "uuid": "4b7777d0-26ce-4629-b619-defaa6912129", "comment": "Malware payload (Dridex)", "value": "2b2daba53d9a0590332e0e120c5a2841d0ff29af26202e19b4eee13aba22a0e40b83f3ae3a0efb12dd81df91ee403796", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945564, "uuid": "e8eecf0a-c985-4489-867d-d8f404927322", "value": "CBF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945564, "uuid": "663ab281-95c9-4b66-b9ae-5b2f55578055", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945564, "uuid": "26b093ee-9169-492f-8b87-8e19df846339", "value": "3072:TwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:TwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618945564, "uuid": "55e634b8-8d95-4eae-8df8-ed07a7ef92a4", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618945564, "uuid": "1e6dae98-5ed9-4773-86ce-5cafb1a299fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945564, "uuid": "45b7a477-bea6-4b74-8398-cf385b4c41b2", "value": "4c151865de15e3ee7b028b8e27540b0c3eea99adb54db2756250c4133ffff7f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a348cc7-a19e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618898598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898598, "uuid": "4ef2940c-b546-451d-a18e-e251d9b4cfef", "comment": "Malware payload (Dridex)", "value": "84f8b40849e14c686f60f66251bc3b04", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898598, "uuid": "37dd3eee-af1a-442b-a322-5b4a647d9e3c", "comment": "Malware payload (Dridex)", "value": "4c3b3ccb40b909c518ee4a9db08e5735baa9468f96194a934e76aeb46278bbd3", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898598, "uuid": "0267a2bd-6569-4612-be98-23a57fbc38a9", "comment": "Malware payload (Dridex)", "value": "8a74ecb15bf77a2319d61a906cc306e91385919c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898598, "uuid": "b94b860c-376e-4fc7-989f-35f0386cf262", "comment": "Malware payload (Dridex)", "value": "13af9a40ed5eb7aa9bdef8b85df74f195a100c21ed710eed5da6019bf3335a1b1fedd78b8be342c3000bff87da10903d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898598, "uuid": "e6be8861-34a7-4ad8-a4cd-1a4a90185b66", "value": "F4F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898598, "uuid": "267b70c4-7c78-4ea4-8d69-9381838ebf35", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898598, "uuid": "e9680f91-35a0-4837-8dfc-de0b07cb9ee8", "value": "3072:Jlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Jlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618898598, "uuid": "1cc85e1a-c06f-4e68-b2da-f11a2b4711c9", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618898598, "uuid": "cf463d46-1bd2-490c-9221-4476c845da1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898598, "uuid": "b32575d4-fc57-4784-ba6e-50565c52825c", "value": "4c3b3ccb40b909c518ee4a9db08e5735baa9468f96194a934e76aeb46278bbd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5384163-a18c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618891154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618891154, "uuid": "47ba36c9-5fed-4d69-ab4c-274a2ac03254", "comment": "Malware payload (Dridex)", "value": "62320a86c5f51d75647da67013a228d6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618891154, "uuid": "0acf2377-fca5-4bfb-b828-25ad1ce0556c", "comment": "Malware payload (Dridex)", "value": "4c8f6cbc5830f38521527ab402582e3c88a5bc5ca50ce2346e2a4d70726438b9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618891154, "uuid": "fdecae7a-9aa3-412d-968b-e816d814f0ea", "comment": "Malware payload (Dridex)", "value": "d26e60af21068337e89acf15419ab4d1fa9cf3cd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618891154, "uuid": "92ee5a57-839a-4da0-b51b-1e565b5738f5", "comment": "Malware payload (Dridex)", "value": "f9f1752eb6beeeda34161f3cb46103ffd1f6806592d58c084a909c7012de5f2059390d84e253cd8f60300a6c707a8c04", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618891154, "uuid": "ad225981-251a-47cc-875b-7bc84da89628", "value": "E4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618891154, "uuid": "f2f046d9-588c-403b-8b5b-109fd87a3e41", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618891154, "uuid": "8b4e86c3-3468-44d5-a428-40f173ac94d5", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618891154, "uuid": "e800cd00-fa18-4875-be6b-6bb99cac2e62", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618891154, "uuid": "39066cb9-0c03-47b5-bc66-bab115158393", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618891154, "uuid": "b9b051e5-570c-4b07-a09c-779eba8d58a2", "value": "4c8f6cbc5830f38521527ab402582e3c88a5bc5ca50ce2346e2a4d70726438b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853f7d93-a218-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618951176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951176, "uuid": "d20dee76-365f-4189-b1c2-3280b4f40519", "comment": "Malware payload (Dridex)", "value": "59b950e43923a7407283a25c194bef75", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951176, "uuid": "c7fda42e-53e3-4bcb-b535-805c94be532e", "comment": "Malware payload (Dridex)", "value": "4ca6e19b04f3235027870bb24c18451a6714d85a650068fda29335a815576d5f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951176, "uuid": "13623843-ec2c-4dcf-aa1d-1ea1dcd8dfaf", "comment": "Malware payload (Dridex)", "value": "597589dd074193f35ca078a2e850a1f61c1e8b8e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951176, "uuid": "9cc21493-430f-4ceb-9c07-4db2e1c04f24", "comment": "Malware payload (Dridex)", "value": "f17bb2cec26efb953aa256c890df7fa56b077b38084986fe451277a7b83786ce094db03991e10eec32c4dd20a0e8d79f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951176, "uuid": "5014a208-aae2-4e41-9f05-5659a8c1c220", "value": "CCF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951176, "uuid": "f2ec7a46-52ef-4b53-8109-1d2381afad1e", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951176, "uuid": "7f5a647d-6688-4446-9b83-69e8f328bd68", "value": "3072:gwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:gwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618951176, "uuid": "0ff1f199-f240-47fa-840d-87d5f7c3f3fb", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618951176, "uuid": "d9b9ff43-601d-43f7-880d-59b45776a4e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951176, "uuid": "5dd9898c-8c17-4e81-8032-c15e199b437e", "value": "4ca6e19b04f3235027870bb24c18451a6714d85a650068fda29335a815576d5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "080e97f6-a1e6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618929491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929491, "uuid": "dad357a9-c307-410d-90b6-503350ad4cca", "comment": "Malware payload (Formbook)", "value": "0c1c3d800568b496753b459c7b48ae3b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929491, "uuid": "a10aa189-0810-4176-a0ff-8a9a0cef44e0", "comment": "Malware payload (Formbook)", "value": "4cbcddaa8a22835c3c728de1e3ed9326f980a16af6e6cc32757dc04ee48d86eb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929491, "uuid": "d5d24950-0d15-4a08-aa52-810a89912470", "comment": "Malware payload (Formbook)", "value": "154bb1111fdb569c4a3a978c8726baafe93f5634", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929491, "uuid": "9d54ff1f-21f2-469e-b130-fb2941fdb2b8", "comment": "Malware payload (Formbook)", "value": "55cc062c9859e037ddf828dc24c9c70baf14aa7cbcf4c2ceef93ec59ec1d9367aabbdf82fb6a4c07b79bb29707d78bb2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929491, "uuid": "c604d629-31bf-4495-9f15-3f575e57391e", "value": "19C42365193C317205F144A9D2FE41FB66E692B29422ED4CE7B902E6E742C33BD7B803", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929491, "uuid": "40e6f8bc-2ded-4a8c-81ce-316625caf51b", "value": "12288:BhzGnZKArkdStacbhZYk4ZUafUCAiYvNiezNRZvZ+Xm:vza0EhZTeUa8sezbZsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618929491, "uuid": "795b1cbc-a5fb-425e-84cd-a28bc9799c89", "value": 556471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618929491, "uuid": "af61af78-c3ef-4bc3-8241-d17ce3cb16e1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929491, "uuid": "8e3fe0e1-6148-4ac4-ad80-c95eac448bf5", "value": "RFQ_R4100131210.pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a4b969-a16d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618877545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877545, "uuid": "fed5c802-4480-4b61-903e-41f09c183a65", "comment": "Malware payload (Dridex)", "value": "2b4f990d0c30073fe00d37345d3da452", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877545, "uuid": "387fb9dd-63ab-4912-84ef-01582a608da0", "comment": "Malware payload (Dridex)", "value": "4cd38b7a5be9e67c16d8a55d748e310b6b68c6deb90e97cd90fd5ab84753b36d", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877545, "uuid": "0fc52487-6e15-42fc-9212-23badbbe433e", "comment": "Malware payload (Dridex)", "value": "49fb8d26696d0ff36fe4d41bfb0ec65d2f31829f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877545, "uuid": "e1b12771-de04-43cf-8def-19ed4ccc6d82", "comment": "Malware payload (Dridex)", "value": "c931a622f39debbb78bf9ef0996ea6348ea01f3774a295fb36e6acd50220ed0a7f2ccccc3d56795272388e788e83efcc", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877545, "uuid": "a2767b23-a038-468c-b872-f7281d31f21e", "value": "40F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877545, "uuid": "4f11664b-2751-4dd7-a6d2-afb54e9edcf1", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877545, "uuid": "3c8cabc8-87e6-4009-985f-3d8bb8354d93", "value": "3072:UWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:U42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618877545, "uuid": "2874712f-34e6-4123-9ae9-1216a492dffc", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618877545, "uuid": "0ccdfb1d-1067-41ed-b572-f017d3a756ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877545, "uuid": "d633c569-b7fa-4a2e-b835-ed92a611b87b", "value": "4cd38b7a5be9e67c16d8a55d748e310b6b68c6deb90e97cd90fd5ab84753b36d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e9d197-a20b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618945750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945750, "uuid": "a2cec69e-45a6-4706-af94-e60debb1f914", "comment": "Malware payload (Dridex)", "value": "03c41cf4612e994a10b6370ae96b7607", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945750, "uuid": "34c80bf7-ce79-4fc8-8153-fa28dfea51f0", "comment": "Malware payload (Dridex)", "value": "4d052c2a4f7cfb82044979366b73ad5c28494f1e4043f1b75e0350beac537f0a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945750, "uuid": "fbd2b0c2-1179-4aef-ad81-1899c1d3b1d5", "comment": "Malware payload (Dridex)", "value": "1e44885fecc74e44c19770a4db40fd4d1ddbe652", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945750, "uuid": "2e84b37f-960b-4a8e-960b-7c7e51f4ba7f", "comment": "Malware payload (Dridex)", "value": "9aa902b379acea6e530bfeb78f261bf30448f8c19012afa7cbae6d513258657023f3024b461f504ee4b57c0e4b072b9c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945750, "uuid": "3d4f9b5e-77a5-43f8-ae0d-97e0d74a343b", "value": "DBF3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945750, "uuid": "c4175d45-1ebb-459a-8d02-bb0413772d90", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945750, "uuid": "46862903-da5a-4e04-834e-5b3687e010c5", "value": "3072:3wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:3wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618945750, "uuid": "c201bedf-9b64-4a5e-86ec-a297bb80a788", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618945750, "uuid": "28f564c5-79ca-46ae-9e82-8b5ec47dc096", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945750, "uuid": "7b561ded-56ff-4ec9-862b-53e527ae3fed", "value": "4d052c2a4f7cfb82044979366b73ad5c28494f1e4043f1b75e0350beac537f0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c060d1f6-a1b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618909614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618909614, "uuid": "ad6aaadd-8fbb-47c9-bdc9-b02ad419474e", "comment": "Malware payload (Dridex)", "value": "d8ec9df611f1d178ebf427808f754a1e", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618909614, "uuid": "fd6d9a8d-b04b-454c-bf77-098d9f24b33f", "comment": "Malware payload (Dridex)", "value": "4d4facbb82f5c816500c5d24298c7ad1f4e3d75a8f92c94f724417345e797e59", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618909614, "uuid": "64e75c87-f9db-4e97-ba8c-f1fdfe147716", "comment": "Malware payload (Dridex)", "value": "adde933227c501f9c8336676c68dccc382051430", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618909614, "uuid": "f084616e-71d6-40e8-afbd-045332e9983b", "comment": "Malware payload (Dridex)", "value": "234e8129cfeb1dfa08c7afaf6788662ed1e22bc8d83d7c8772c5cd588d1c695df9e8ee435cb4db983e1c3407b98c775f", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618909614, "uuid": "a9e6b86d-69e4-416d-9c27-1e724c9b8fd5", "value": "F3F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618909614, "uuid": "df635040-1771-4698-b5e3-4141137602a6", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618909614, "uuid": "28f557a3-9fcd-4a6b-9cb5-2547a34b7f4a", "value": "3072:ilpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ilo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618909614, "uuid": "89f275a2-1b32-496b-bbba-52ab7ef594e2", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618909614, "uuid": "67c832e2-863c-44c0-9e80-af0fa7dae3d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618909614, "uuid": "9880e570-c172-492d-85f4-f3d26bbb221b", "value": "4d4facbb82f5c816500c5d24298c7ad1f4e3d75a8f92c94f724417345e797e59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5eccb4-a1d0-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618920294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920294, "uuid": "724a23ca-c0e5-463d-aa51-8b3ca2d6980c", "comment": "Malware payload (AgentTesla)", "value": "d050be109b43b8ec300ed55a187b91eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920294, "uuid": "4396858e-7301-47a8-be58-1787c233b5a6", "comment": "Malware payload (AgentTesla)", "value": "4d5efc07157713342c2b04e645ad4df03a689c09f92c928024518ebffa883bfd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920294, "uuid": "c8f47c21-bba0-4643-8b42-654af68ede79", "comment": "Malware payload (AgentTesla)", "value": "da5a692e7a70d63d68e75c59686d532dc165bf72", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920294, "uuid": "49abb1cb-2836-49cf-95d9-8ba3cfefa212", "comment": "Malware payload (AgentTesla)", "value": "32e8e21ffcdd34ab21907132a2d7f0f0b63e06b947ebdf65573f03f899904f449fa41fbf3a696ce74ffd488f4d7de965", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920294, "uuid": "0d8aa5a5-bc2f-4698-987c-85b31d413c31", "value": "BA25DF253FE5CF18D2BA4B7888B4925093F9FC119B1BC70AEEA135DC5E70BD45E16282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920294, "uuid": "39b8d9a8-7f6b-43d0-bd71-6c93a1cc9881", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920294, "uuid": "e4600db8-40ca-4399-a4b1-aac6920c4817", "value": "24576:IkHROBOobXV3XH+RCmSH6sOEQ86oytz0MRRRRRNt:IkHE3bXAEjys6IMRRRRRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618920294, "uuid": "775be8f8-53d3-4a24-a7bf-8c22c57c4624", "value": 1050624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618920294, "uuid": "fd21c74f-0ced-4780-93c9-0ed385bf0c7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920294, "uuid": "6a616385-f7dd-4f53-8885-9c396268d032", "value": "d050be109b43b8ec300ed55a187b91eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40bae4e0-a223-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618955785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955785, "uuid": "f6e0db88-f219-4ae5-8261-689d3a13e9a1", "comment": "Malware payload (Dridex)", "value": "0fe34ef6ccabd1db65a24595143e09e5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955785, "uuid": "9322c643-fcbd-4168-ac4e-b8f50e6021ac", "comment": "Malware payload (Dridex)", "value": "4da3d813de263f83a1006dc5c370ab4592f4b71fbea0e2faa58a5858fc6bd14f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955785, "uuid": "d1cedc92-63c2-44c1-a233-3d1704b1f951", "comment": "Malware payload (Dridex)", "value": "b9fa9450eccfa5929ed10413fb909e03ea302a57", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955785, "uuid": "d9ec8aa6-7195-4715-a58c-4c6b13d93daa", "comment": "Malware payload (Dridex)", "value": "f87f66ff35ec70a3724ed4d7aa61295bee9a6d5c54c276647a299022154462e01cb7c030872337cbe7a9a19f71d695ad", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955785, "uuid": "f9afb919-5760-470d-b7a1-1c0387372d5b", "value": "1CF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955785, "uuid": "47ecfd84-05d7-45fd-8b2e-1ca7878199ed", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955785, "uuid": "e0a004e2-7cb7-4e50-aa97-3c119ae64737", "value": "3072:kwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:kwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618955785, "uuid": "628b6fa4-0e62-4269-8b55-3c8c52273a18", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618955785, "uuid": "b525a643-bedd-4958-98fb-6644dd5f828d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955785, "uuid": "a6247893-eccf-4c12-b10f-05cee4edb25c", "value": "4da3d813de263f83a1006dc5c370ab4592f4b71fbea0e2faa58a5858fc6bd14f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a546fa-a195-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618895068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618895068, "uuid": "5ff8f892-2593-4460-b278-876f9407cde1", "comment": "Malware payload (Dridex)", "value": "0d51ee414260ade3b38cd71cf5f809f7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618895068, "uuid": "7a0274b5-6508-437b-9116-1e4fd44438a6", "comment": "Malware payload (Dridex)", "value": "4dc1b1e64aa305fb1564bb776927cf85c31a931a2719a70bb600f470dd0a7afc", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618895068, "uuid": "3f910c87-b51e-4215-a7e7-5e911227fbd8", "comment": "Malware payload (Dridex)", "value": "d6ebebc3512fb43bb04066c4c4454fb9275ac3d6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618895068, "uuid": "612f95e2-0107-4d40-883d-f7a57a919a7e", "comment": "Malware payload (Dridex)", "value": "8dec176a91d749f0b05ed3851f840e29f5c9241860d991d4bf0eded88188c489c8aeefc8b2dc1b61e70d07808d93e300", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618895068, "uuid": "bc3b96a7-aadb-4664-94dc-68eb54f62cd1", "value": "F3F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618895068, "uuid": "71ac0d39-518d-4245-b157-6f5646de6004", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618895068, "uuid": "3045f3ef-2a51-408e-a39c-3d3628fcf57c", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618895068, "uuid": "09fdf8cd-98a2-45f3-9768-012e09ce4ccb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618895068, "uuid": "02b63a8e-5e0f-4a51-b441-f3225209b095", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618895068, "uuid": "63209a25-b896-4614-944d-46ac39ac05d4", "value": "4dc1b1e64aa305fb1564bb776927cf85c31a931a2719a70bb600f470dd0a7afc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d7a5b2-a212-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948726, "uuid": "4bf4f33a-8812-4583-95f9-f25befb1e3ba", "comment": "Malware payload (Dridex)", "value": "929fe464d3e8c64a78827f3687547e36", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948726, "uuid": "b29f40bb-7e07-40dd-9f24-9ded8e5bf313", "comment": "Malware payload (Dridex)", "value": "4ddb3df9abd87801eeabb57574a9b9cad416939f1311cf2a76e23bde1834c136", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948726, "uuid": "e49d3033-4b1e-42b6-a39e-e9b7b6f6f3df", "comment": "Malware payload (Dridex)", "value": "c900f3e1af5fdf56424b856d3d66e79e620dad99", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948726, "uuid": "928b290f-454f-4c60-9d63-bc9bd3f16575", "comment": "Malware payload (Dridex)", "value": "f2fd49f05e33ac28365f9b316a6791de51f1c35208d31ed1b100cb0054492d5b3b7d2a19fdf478e33e5149a444801854", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948726, "uuid": "e7c93553-8049-44d5-95b8-d3863efba62c", "value": "81F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948726, "uuid": "f2f57cf7-918e-4d87-a135-3b1435db8ed5", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948726, "uuid": "27a3fcd7-9fa6-4064-9182-c6d880c0b289", "value": "3072:rwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:rwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948726, "uuid": "1d09fae5-1bbb-43e2-be88-a34ba033e652", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948726, "uuid": "14405db7-580f-417a-a4a1-f2254a1739e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948726, "uuid": "73b7248f-0f9f-4dbb-b9d2-0a9bd013ae45", "value": "4ddb3df9abd87801eeabb57574a9b9cad416939f1311cf2a76e23bde1834c136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc9f712-a215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618950033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950033, "uuid": "a6dc5687-9a58-4654-b96d-ccf59368cb80", "comment": "Malware payload (Dridex)", "value": "9b388c4a9794f263c8b9a4a114f7812a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950033, "uuid": "bde5f7e7-59f0-422a-b038-fde116b53de6", "comment": "Malware payload (Dridex)", "value": "4e09b92cd5598590d3ee1585743f8bb1910f41a82168d9eb47bed629d20cfd04", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950033, "uuid": "375650e6-baa9-4927-88d0-ebd42dd4b05d", "comment": "Malware payload (Dridex)", "value": "ff7e4b17acd6d12810298fee227634b9bbb74d96", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950033, "uuid": "906c47f7-e63f-4a47-9634-bd140a01490a", "comment": "Malware payload (Dridex)", "value": "011ef579e5b56ce994d9924114064b467a6172b4a7395f8e4b2bdd92f4e0713c2c23e3800132951cf7bad686f3c767b9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950033, "uuid": "93dbd0b1-1845-4b1e-a4f7-ab4e56833978", "value": "75F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950033, "uuid": "7969020a-1e28-4d01-9345-5b5038266e1d", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950033, "uuid": "9fa9d9ea-e29b-4520-bbca-a769524a26f3", "value": "3072:swZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:swZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618950033, "uuid": "c22b449d-91b1-48ff-8662-f74b7a90182b", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618950033, "uuid": "bafc5132-60da-4a87-a4f1-5bf4f7f746b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950033, "uuid": "5ba68f89-1f49-4a85-9a65-081f5de28d5d", "value": "4e09b92cd5598590d3ee1585743f8bb1910f41a82168d9eb47bed629d20cfd04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72ad9d1-a200-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618941059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941059, "uuid": "0f301e85-001e-4513-9e57-0eab4c9d621c", "comment": "Malware payload (Dridex)", "value": "e07526c00331ad35407adb524aa32c36", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941059, "uuid": "d9db0f2b-9e2d-434f-8fb4-a5ba62cc0c6a", "comment": "Malware payload (Dridex)", "value": "4e114b4c469eb27cf61cad716b42d61122f81eef677c2bc59243a8c9a9b0938d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941059, "uuid": "861795e2-6f2b-4b5a-b2c6-fbf49643cc31", "comment": "Malware payload (Dridex)", "value": "78fca17d7db4a145c3277ba4248f99ff6bc7d56c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941059, "uuid": "9e72be37-68e5-4ad1-8a90-9bc3b6c6aaf0", "comment": "Malware payload (Dridex)", "value": "0df482e23267971f86000eb14ffc07897cc97d790135b7ab2f369ce88c6dfb2d88c26fdf094cfc6c608dc24a2dc14488", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941059, "uuid": "77c96a01-0b8d-4d79-8578-e8b249150b78", "value": "F6F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941059, "uuid": "c1ee96fc-ae32-43be-abc8-fbc2f3d54aff", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941059, "uuid": "94ca36cd-1f17-47c7-a282-f5b52daf526d", "value": "3072:BwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:BwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618941059, "uuid": "42a5daf9-a3ec-400d-ada7-768751871ab8", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618941059, "uuid": "78466678-28b9-4f10-be3b-7e08db3d79c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941059, "uuid": "23a55e11-37e0-4189-acc6-fe7e2880edfe", "value": "4e114b4c469eb27cf61cad716b42d61122f81eef677c2bc59243a8c9a9b0938d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a82bb3-a210-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618947712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947712, "uuid": "d35f7811-cd7a-48a9-b7b2-49aa980fc2b7", "comment": "Malware payload (Dridex)", "value": "87e49e24fff1d46b3325fec3206c8981", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947712, "uuid": "4d869b98-f50a-4fc0-9fde-49bb35cf9eb2", "comment": "Malware payload (Dridex)", "value": "4e29e6a6e0a01a46aabff8c273bcf86b170a1d07d4f1daa8a502173169226406", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947712, "uuid": "a548dc66-c5fa-4674-9bea-1e1ddc24be6c", "comment": "Malware payload (Dridex)", "value": "da48a760f63106a32993b60e16b6e8444b2f35a9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947712, "uuid": "fe3e27af-2111-430c-8290-afa8cc6b33eb", "comment": "Malware payload (Dridex)", "value": "8cd455ba8459d31d8cee351ec6ae88a773a242e7e17adae4fe21ee5b1533e957f808305415960524f79365fd10a12ec7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947712, "uuid": "2f378327-08c4-4586-b2f3-bbdc8e842699", "value": "3DF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947712, "uuid": "6011dfeb-da28-4c69-82cb-93c211740027", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947712, "uuid": "7d806ba9-e787-4f8f-b811-9e76e4d285b6", "value": "3072:gwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:gwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618947712, "uuid": "5de134e0-dbe1-40c2-89b2-b87d53c7d151", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618947712, "uuid": "001d0fe9-809a-4ff2-b174-60bddf74d1b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947712, "uuid": "0959e6b1-a4be-4697-998e-b3cb952b18c8", "value": "4e29e6a6e0a01a46aabff8c273bcf86b170a1d07d4f1daa8a502173169226406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd0ff01-a204-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618942547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942547, "uuid": "45050bca-3aef-42b3-a0d8-06101dd298dd", "comment": "Malware payload", "value": "8e9021574d0fe82039bec1bb003f450c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942547, "uuid": "566f6f3c-d8a8-424f-b0d8-a999f0030d4d", "comment": "Malware payload", "value": "4e4d73bf4e8d4a7bf05dd82d7dfc06f8e6e12be209275b47183972ee9ac230ff", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942547, "uuid": "30912384-c0b2-44a8-818d-40647fda0b45", "comment": "Malware payload", "value": "8183052d79b6f3a54c851eca5c0da0e15fda3c69", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942547, "uuid": "b22c6cde-2845-4dbf-9113-d75aa1490b4a", "comment": "Malware payload", "value": "83c8392ad80d63cbc08ec44616bbfa9d6e3f5605281c999417cf3947e90c26e4e88d6b001156638de767a26da749f8e5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942547, "uuid": "c7ab5988-2a64-4b63-afef-2fa5cfe979c8", "value": "C6F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942547, "uuid": "68997d4f-4377-481a-bbfa-badf96c836c1", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942547, "uuid": "77b7bcb2-f647-4408-b3a4-dc94f649bb10", "value": "3072:GwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:GwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618942547, "uuid": "0d7fca4f-4823-4de1-96d5-23ced8127ffa", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618942547, "uuid": "d078f101-84cc-4040-a60b-f6f0da693d61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942547, "uuid": "cdbcedfc-b1c5-4fa0-abff-76469f5b11db", "value": "4e4d73bf4e8d4a7bf05dd82d7dfc06f8e6e12be209275b47183972ee9ac230ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcfd159f-a18d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618891569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618891569, "uuid": "f274abe7-f6a1-4530-84a8-78fda6040465", "comment": "Malware payload (Dridex)", "value": "fc6af4812fd5dd6ff3196b11f6f6d3a1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618891569, "uuid": "f5dddf29-2229-4927-9169-ecf657968444", "comment": "Malware payload (Dridex)", "value": "4eacb703f72c77901bd8ae66e628385cb0be2a8fa08837cfffabdfbe86bc7c6a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618891569, "uuid": "7e44d6b9-e266-4bbb-b7d5-090097dea860", "comment": "Malware payload (Dridex)", "value": "bec1933d0b845672e0f93f8ab1acd19b5084fd81", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618891569, "uuid": "eade3492-0d9b-46f0-9ad8-6dbb55e4a9a7", "comment": "Malware payload (Dridex)", "value": "fc1c4e1913d225312014c102b30c4b08ab137400086405f2953a9a86ecf50339ef48729c576fcad8d3b1e81e7e0268c0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618891569, "uuid": "f19ee4ef-e1c7-4688-ad8d-e801267df304", "value": "26F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618891569, "uuid": "9deadaff-d3de-401c-9f14-a36be168e2fc", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618891569, "uuid": "508419f6-1c92-4467-af59-7ae45d978df6", "value": "3072:hA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:h3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618891569, "uuid": "211bf584-d798-4337-9cff-20ade3beacff", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618891569, "uuid": "d6c57346-0489-41f6-ad9d-ef2da0a8c2d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618891569, "uuid": "07ca2508-275a-4cba-9006-8a02514b62fe", "value": "4eacb703f72c77901bd8ae66e628385cb0be2a8fa08837cfffabdfbe86bc7c6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb502012-a20b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618945764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945764, "uuid": "a22a1c90-9461-4cde-8c25-e11f95091071", "comment": "Malware payload (AgentTesla)", "value": "6cf1530319b6321c478c4f021c1589a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945764, "uuid": "b18b9a81-57a5-474a-a79e-70924b8faad1", "comment": "Malware payload (AgentTesla)", "value": "4ee91a96f4f8219145c883b6e785869dcec4a22bc98e9c95a8472fbfa2c63148", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945764, "uuid": "da33f68a-2322-48d4-8c00-90a34250ba2c", "comment": "Malware payload (AgentTesla)", "value": "e2ececd28331ea855b0931ee7f4136b32e9b0c3d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945764, "uuid": "a0121b62-ae65-4ad6-9365-e3bb7de98b79", "comment": "Malware payload (AgentTesla)", "value": "bc4694c9efb698b3ea39f40d49cd125f1386e27bd5a62efebf6676701a746090c373c8ef1544d070cb4f1447ed377436", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945764, "uuid": "9e4333ab-2195-4af0-ae6b-f174e02bd65c", "value": "66E20A5B11947689E8A345342891EE343B2CA7B05894D11EE47285ACCFC67FF68ECCED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945764, "uuid": "2a9cf68f-90a4-4aa6-8944-37ad7b9a42c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945764, "uuid": "f5065967-bafb-461b-a405-14fbf5a459e5", "value": "768:5wb5INO8MkP2CwezYVw2NWrmLmqnL7hCuFtiZhW:5wNCaKHew0Wrmdhzkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618945764, "uuid": "db0c6b97-fc2a-4f22-bc47-19b5bf10159d", "value": 33920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618945764, "uuid": "852d42f5-a12a-44aa-91a1-4936560425e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945764, "uuid": "734d374a-56a9-4303-991b-72016c94c7bc", "value": "6cf1530319b6321c478c4f021c1589a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "431d6543-a1f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618936891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618936891, "uuid": "a949c0a1-83b2-4838-9fb9-2d4d7b006494", "comment": "Malware payload (Dridex)", "value": "2176129d11ebe639b3456f811228a427", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618936891, "uuid": "930170a8-d4e2-4582-8cea-af1c99cb448f", "comment": "Malware payload (Dridex)", "value": "4fae28559e6326c4fb629ca797a122108d3074ca81706ffd225c631f817c9609", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618936891, "uuid": "753d4a3e-394e-4812-82f4-a7e6f9ca0599", "comment": "Malware payload (Dridex)", "value": "1e547fe31b1c9fee58aba086f08aad08193fa916", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618936891, "uuid": "9af1bba7-3b6b-4028-82a2-9a60d370bd0c", "comment": "Malware payload (Dridex)", "value": "2fa7f2763ea7e1657a482d7b8776be04d91046a00e8d72a4d06335e11367158a66efcbf1d72f11ec3f0e46e0536c15b9", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618936891, "uuid": "4d9febf5-971d-4e52-82d0-072e384cfdf7", "value": "09F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618936891, "uuid": "457957c1-6fab-4207-91de-a06bb0f77c98", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618936891, "uuid": "2456b6ac-f544-4835-9e31-c79fcffdb078", "value": "3072:OiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:FeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618936891, "uuid": "d397c611-493f-49bd-8387-b0e86b9af7e7", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618936891, "uuid": "d8790451-e17b-4cf0-8e9f-452c04038862", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618936891, "uuid": "e308405d-9d6c-47e2-8233-4ea726e82520", "value": "4fae28559e6326c4fb629ca797a122108d3074ca81706ffd225c631f817c9609", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e411d070-a22e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618960784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960784, "uuid": "3e017cbe-e7c4-4716-8290-954420efa99e", "comment": "Malware payload", "value": "7660df25b16ecd98b9da88f80803bdbe", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960784, "uuid": "65a54ca0-3f1a-4e87-8931-512abbd8bb7a", "comment": "Malware payload", "value": "4fe9c9e8bc2546561900928ed8806349ad10cec1fc79712d2590cfdeee40bffe", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960784, "uuid": "7a380ffd-f8b6-4c4b-9123-63732bbf9511", "comment": "Malware payload", "value": "7600d6a395d480a0332c3c356f424ce2a9f713ba", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960784, "uuid": "92ad41d1-cc78-4bec-9407-fe33750d7b65", "comment": "Malware payload", "value": "c7a4f43a9fdb8efc0d4d4cec9462dd5f2df12098f80264642fe00ebb8534b403e54fdad046f68c45dfc944f1994b8b88", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960784, "uuid": "ca001a90-c397-4cc7-be71-6ff6500c335a", "value": "DFF3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960784, "uuid": "1faf7d1e-0c04-4fae-9268-4b1b9fdee96f", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960784, "uuid": "f49c844a-59e7-4992-a084-bab4f33f2e22", "value": "3072:iwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:iwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618960784, "uuid": "d4df88c9-9901-49ea-8b52-50689128ec0d", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618960784, "uuid": "f3ce1f27-9d2d-460d-9ad2-ce05b6d0e1fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960784, "uuid": "9f5b9ba1-8bfc-49b3-9a80-cc632b7206da", "value": "4fe9c9e8bc2546561900928ed8806349ad10cec1fc79712d2590cfdeee40bffe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25d1789-a1a6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618902343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618902343, "uuid": "6b15abe7-9c6a-494d-a380-4c82894dee0f", "comment": "Malware payload (Dridex)", "value": "74a4304ee41767e651273eb5f91ea7c7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618902343, "uuid": "af184d0e-3d44-4914-afc4-2f868e87bfa2", "comment": "Malware payload (Dridex)", "value": "5003e8ae41f02500ce48e294edf165a13d3bf963e2d6a3f7d0bf2cb6473097c3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618902343, "uuid": "613e8a08-daba-4c95-8ee6-daac2d5b894f", "comment": "Malware payload (Dridex)", "value": "3beb3f014833122b560cb0c10281259391096e61", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618902343, "uuid": "d5bf4861-ecd4-4858-9e5c-efa0d6f30803", "comment": "Malware payload (Dridex)", "value": "be3ffe3644e0c898b364f17f6b1667f0771f5b68a3c4a5beeacfd15d361cd50fae3b4a8baf8027d86924c82998414f10", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618902343, "uuid": "ab8f0d09-82e7-49eb-82f8-ac9edd54464b", "value": "C6F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618902343, "uuid": "da06950a-1053-42f7-a2ec-d815b166e6ac", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618902343, "uuid": "d25a0cf5-fb6a-4de8-99a3-1180e1400fbb", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618902343, "uuid": "32d8cc6f-f718-48c6-a3a9-2e94f2bc9588", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618902343, "uuid": "773d43b5-75d9-43fb-98c6-28f9945c05c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618902343, "uuid": "e76f9b22-a84b-4a63-8728-906c8b2c603f", "value": "5003e8ae41f02500ce48e294edf165a13d3bf963e2d6a3f7d0bf2cb6473097c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ecf3dc-a20f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618947310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947310, "uuid": "b395e58a-2c1c-4ffb-8f01-d88d7666226d", "comment": "Malware payload (Dridex)", "value": "a72d60afa3dd981660531d15eb8d4cd2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947310, "uuid": "eb12e100-a5b0-4de4-8ecc-7ff40e9dd6df", "comment": "Malware payload (Dridex)", "value": "504f33f51816f7088565c2d10cc970ac7dc336805da9f6d16cf0ac7668fb7e82", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947310, "uuid": "4c8a63de-34c8-4129-b694-fbd728063135", "comment": "Malware payload (Dridex)", "value": "8e6eb358d83ef85fed63cd15daca75f86a938819", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947310, "uuid": "4dab77a5-af82-425d-9a97-604d2eef280d", "comment": "Malware payload (Dridex)", "value": "08188b8026f10316ec9e24a98ba53ec8d50fb3db813b9ea319239c9ac8dc4516fbfead2759bcde661f384177a0c5e63d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947310, "uuid": "ffbd3099-bbe5-49a4-b631-77919aab5d0f", "value": "28F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947310, "uuid": "2ca2dc89-3a79-4b4a-bf2a-1fa88e7207bf", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947310, "uuid": "ab8f8ad0-82a9-476c-a49e-ec61fd1c2545", "value": "3072:iwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:iwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618947310, "uuid": "8e4de194-e69e-4940-9c59-eddcf4316b3b", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618947310, "uuid": "c21c4f21-b864-46b9-8197-82bea47a88a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947310, "uuid": "b6546ec7-0ae1-49e3-8451-2c7a8b7b1f04", "value": "504f33f51816f7088565c2d10cc970ac7dc336805da9f6d16cf0ac7668fb7e82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7cf937-a1ce-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1618919276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919276, "uuid": "de6f66ac-c732-4ac8-999b-597605c2d76a", "comment": "Malware payload (OskiStealer)", "value": "d20d0d39b52c812da0ae519d68aa889b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919276, "uuid": "d6538504-bd35-4b73-8e0a-7d4edea99980", "comment": "Malware payload (OskiStealer)", "value": "5069de588ac1f23d1cfa14c3ee61e5bc351d0314a5bbac248a5210a9db7e5a8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919276, "uuid": "c8770983-9f4a-48e2-a947-b7bce06b1cae", "comment": "Malware payload (OskiStealer)", "value": "0ce65d8119d415a5df76080625097acfb1359514", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919276, "uuid": "b4703448-90e9-4b12-a0bc-85f92addf3d2", "comment": "Malware payload (OskiStealer)", "value": "dece7f37567c1f26f2c24888ba547c4ad601ac2b6b4778ee821d56b424b8d60d40dd96738f4ed1a72723402adbff7970", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919276, "uuid": "d7d6a0da-b851-414c-a3ea-459971e8d83e", "value": "B9441200A6988639D954CA72EE358220C3309C2FE82641EBE85CFF4F7579BDDF5546B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919276, "uuid": "8bc68bf7-a7bc-4e5b-92cf-dc81649cda56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919276, "uuid": "d5cdba32-53ef-4b5d-928a-c7615b5ea824", "value": "6144:DRwtfUeAIQHuA36cd9E7mhXPwC2lIXXCP6VLNjAJZQ:+eeAItC669gmVd2GA0BAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618919276, "uuid": "86507fc0-d683-42c0-baa1-1889bab0fd6f", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618919276, "uuid": "883dd9d6-ed68-4fe3-9ade-233ee6e152de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919276, "uuid": "da6b293e-6b01-4c68-b01b-c935711ab3f3", "value": "d20d0d39b52c812da0ae519d68aa889b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f1c4aa-a1c8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618916715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916715, "uuid": "c8ff554d-0a8e-4d5f-8c85-08a963d236f2", "comment": "Malware payload (Formbook)", "value": "c1a093f5b81e9d3cab8df69bb5cdeb85", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916715, "uuid": "aa16b23e-b8e5-427e-88dd-3df1b5e992bc", "comment": "Malware payload (Formbook)", "value": "508c4b26b445e70c282e7b28acd7bd6ee31c1df6bc8b0b3574a6238bd230aa5b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916715, "uuid": "9c62a7ec-de33-49a9-8862-2d2cb7b226ac", "comment": "Malware payload (Formbook)", "value": "c16eed3c2ebfb3669445a46dd5cbeeb6c38bbe97", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916715, "uuid": "c84ddf50-a586-467f-89d9-e130759bdfd0", "comment": "Malware payload (Formbook)", "value": "ce331adbad33a40380ef770a9190c61f3fb91664fd20f422a1a8b86c815d66e7a45813fd3bd7ca8c3875824f05f473d5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916715, "uuid": "3f33a098-34bf-49ce-a8f7-f5184537309f", "value": "01B53303B9938F26DB6A9876825FA55A0C695C50FD920E1F7718323C71BF43A3DCA718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916715, "uuid": "1537923d-96ad-4a8f-b76b-d8202caf9bcd", "value": "49152:xYlpDYfn6ZQnOig+c6f19BbRs/DDIOi0//2lz2I:x6ZCPg+5fNls/bQlz2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618916715, "uuid": "ce169fe1-c89b-4e4a-ba68-0033578c6ad0", "value": 2459648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618916715, "uuid": "dbb55b07-aeb2-4d18-8af3-d0a78096c997", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916715, "uuid": "c86ffb64-b37e-4829-a73e-c7b4cc650df7", "value": "Quotation of 210409 from KOSEN-1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1646509c-a211-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618947983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947983, "uuid": "365dfb43-9282-4d1b-a659-c830db8dd75d", "comment": "Malware payload (Dridex)", "value": "cb2cbb6e57fbe74e1afea928b6cce046", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947983, "uuid": "7301256a-f91d-4f3d-98a8-0bd6a6e6d8f1", "comment": "Malware payload (Dridex)", "value": "50ba8826bff4b6889af9603b09037abf4934cd97c05430b19046eae9a1384abb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947983, "uuid": "330a3f2a-f418-4fce-a399-537acebf48d3", "comment": "Malware payload (Dridex)", "value": "45ac5b8bf6012e1722e5b2e25a6f14fed594b91c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947983, "uuid": "76ba6bf7-235c-469e-9abb-4e258d74411a", "comment": "Malware payload (Dridex)", "value": "0241301f81e7e7b6a0bec433e78537ef2c94cf39836561ad5830920cc544bfd523ecdcf94075a367e358185577661632", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947983, "uuid": "de59ea60-5195-428a-a176-06118b262fff", "value": "51F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947983, "uuid": "f148d908-f1aa-4e02-95e7-231e5b4ff209", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947983, "uuid": "709cf76e-de3a-46df-a06d-d3244aec2c0b", "value": "3072:EwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:EwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618947983, "uuid": "fc90d3da-d069-42af-88e2-d97438d408da", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618947983, "uuid": "97819e54-c987-409f-846d-ca6a3c49d564", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947983, "uuid": "6f7a929d-2d22-4b74-a75d-bff077a8b49e", "value": "50ba8826bff4b6889af9603b09037abf4934cd97c05430b19046eae9a1384abb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ad1fa4-a1fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618939204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939204, "uuid": "ae528870-5cf3-42d4-ac69-acfc8ea1c0d8", "comment": "Malware payload (Dridex)", "value": "bd847896f53a17c88b92659fc37c857d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939204, "uuid": "f06132dc-a9db-40ad-9c82-b6b52864658a", "comment": "Malware payload (Dridex)", "value": "50fb38300757293ce1d5123841ec711300b2e6459ef864b260fa57c7f6131a5d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939204, "uuid": "d281306f-0aca-4728-9b10-24f261c6d4a3", "comment": "Malware payload (Dridex)", "value": "980c0e1850551df5197411d53e68f0b946a270af", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939204, "uuid": "eb436c42-e868-44b4-b8cb-33cfb185c6c6", "comment": "Malware payload (Dridex)", "value": "38e00d8cba333432ac5e58277ced463a6df32ceaa789b587e9374c64bdbd564d6d44cacfdac8362fbd623a4e3c7316b3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939204, "uuid": "c3f5c4bb-8290-4d6a-bef9-29ce4dbd8008", "value": "A5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939204, "uuid": "30ef30ce-ca6e-472a-9603-583ef8d758a5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939204, "uuid": "d48d54e7-cb11-4b30-b2e6-7c3185894112", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618939204, "uuid": "8fbf547d-cddd-4e54-8840-41be8e7b2c1d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618939204, "uuid": "7a07e539-a1c7-40df-b4bf-eb050aa5b2a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939204, "uuid": "f10d75b3-a4a3-42aa-a5b5-75d9400541d3", "value": "50fb38300757293ce1d5123841ec711300b2e6459ef864b260fa57c7f6131a5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6740de1d-a1c8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618916766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916766, "uuid": "0e98c123-81f1-4492-a225-972e30caa6b5", "comment": "Malware payload", "value": "750dd99ef3c43c27c8259a6cb6ef653a", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916766, "uuid": "4c620aa3-b01b-443a-b125-57969b912b9b", "comment": "Malware payload", "value": "50fc307d69a0ff2c322d9911e20a5b4e665bb41e62de53e07d891e1373c18e1a", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916766, "uuid": "856f02b7-990f-427d-860d-a523353a6597", "comment": "Malware payload", "value": "90fa615138c1445878fcf4c1421e7a88f3c576f0", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916766, "uuid": "b01059b9-f442-4c20-aa87-2d933dd2181c", "comment": "Malware payload", "value": "61052145c94805540161221e68d77cdddd2137ea7dadd38574839d8c7ea6064b577f520b7fb4ffad1f2d032e1aa933d7", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916766, "uuid": "11c05d5f-100e-4c22-bcf3-c3421cfa52cc", "value": "A864225EF9E35657E45F563E3514191127A2EC19431A38EB02C7B3BE42B2B17E3022BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916766, "uuid": "3b55cefd-b37b-4f00-a0d9-c97aec8e5f90", "value": "6144:Y0fLN89uIk3E+m2s7Hg7lkWCr5K0ssEvDUw0142weixfGPvbtzh0tDZx:Y0fLNuCdspWZh/vDUwg422x+Pztzheb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618916766, "uuid": "3bd6e901-b0d2-47ef-ac83-5598ccc31103", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618916766, "uuid": "e18b6ede-f627-4c95-8f9e-86380877e5bd", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916766, "uuid": "1cfbe9ac-68f4-49de-b46f-b4bdf1a4e031", "value": "presupuesto.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b1689d-a221-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618955091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955091, "uuid": "cb11b3df-b2d4-4908-a6c5-f7862d6a4c31", "comment": "Malware payload (Dridex)", "value": "bfc236f315eb11761fa1e3403bf2d894", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955091, "uuid": "7f4ec6f6-d9a0-4d69-839a-ebf94129dc08", "comment": "Malware payload (Dridex)", "value": "519830988d855db9ea55354ecacbcc9a72d4523c574c773cfce379db731804d2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955091, "uuid": "cf712d24-00fa-451d-a7e8-9e60ada61ab4", "comment": "Malware payload (Dridex)", "value": "6c6e9a21070217a19360ad4be3effceb54142883", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955091, "uuid": "99880f5a-b52c-4a17-a147-8069a0e9193e", "comment": "Malware payload (Dridex)", "value": "b807ac7414e3ff89d48806cd7e63b3f0266d597c574c5ea2838b97905a061a551aa21e8b787189555706a1fac1b13143", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955091, "uuid": "8781eb76-6915-4f5d-bd74-f93c8fda08dc", "value": "A3F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955091, "uuid": "7228551d-7cb2-4de7-b68a-400f3cc4fab5", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955091, "uuid": "6479fab9-f93f-4a7a-885a-fab81d666ef4", "value": "3072:LwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:LwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618955091, "uuid": "cfce5ef1-99e8-430f-9ce3-23f2fa7b7e2b", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618955091, "uuid": "d1013c94-af29-4e29-913c-c41cdd2814a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955091, "uuid": "3f0196dd-eafb-4b20-9491-906072e8749e", "value": "519830988d855db9ea55354ecacbcc9a72d4523c574c773cfce379db731804d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009c32ee-a204-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618942363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942363, "uuid": "06f7d3de-ce8c-422b-babf-da292d948fae", "comment": "Malware payload (Dridex)", "value": "7e3808c4931bc38545880d1e0325a502", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942363, "uuid": "63a8354d-549e-4cf7-8c76-8a384793b366", "comment": "Malware payload (Dridex)", "value": "51a23f56c3a7732b0e0590668da1c879a557d38b8a84a40dd461fd6e14e005c7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942363, "uuid": "19bb0f8f-247f-456e-807e-f7ca522dffe7", "comment": "Malware payload (Dridex)", "value": "5476785f92abbadbd7792721541e1c3e67044bba", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942363, "uuid": "be8cb22f-5469-4585-8014-21c6b5d0e678", "comment": "Malware payload (Dridex)", "value": "46ac33ad1accbe7302681989c1f536f433b7e64bf78f218cae1f39b94d5f8338348a3f415a70649e3fd9adf6d2dd3c73", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942363, "uuid": "5717f390-6368-4619-8052-ceb7b000db16", "value": "B5F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942363, "uuid": "d237c95b-475e-4437-9089-fd8977304812", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942363, "uuid": "8d83812f-e304-4066-a278-ce004fc1952a", "value": "3072:xwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:xwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618942363, "uuid": "230700eb-5015-4095-8294-da00b361e14b", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618942363, "uuid": "e18f12cc-7a3c-4ee7-b47a-ca61e4504032", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942363, "uuid": "f76a705d-bf0e-4fef-adad-a8076959e161", "value": "51a23f56c3a7732b0e0590668da1c879a557d38b8a84a40dd461fd6e14e005c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345153a0-a209-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618944598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944598, "uuid": "e9844a3c-713c-4f67-8d53-de85b23c18ae", "comment": "Malware payload (AgentTesla)", "value": "67f9d2b6e4bd8b9e54309fc713de996a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944598, "uuid": "7e85ab96-8a53-4343-8478-f62f37169c1d", "comment": "Malware payload (AgentTesla)", "value": "51cc20e327a7dccfc47583528b0f655e665dd53e3d645478cbff8aeceffdeed0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944598, "uuid": "4c8c4dbc-b2dd-4121-bb14-7e72e78027fc", "comment": "Malware payload (AgentTesla)", "value": "7fa09dcd9cc415d432bc1c0574548a556f0999ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944598, "uuid": "2ed42a89-0f83-4abf-99b8-45158f01b978", "comment": "Malware payload (AgentTesla)", "value": "bf59ca1e10461d863877720464b5d917107976f9d4a87d42e755976aa3076dade31cbe30f44ec159720035abd9414686", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944598, "uuid": "5857527a-8ff0-47a8-b4b1-3a35b60a76fa", "value": "3EC4AAACC09742E88F89ABB86B1F2F85114C7A6EF744A5337234977527E2C7B501687C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944598, "uuid": "0e3df509-d85d-41ff-8ca3-4c1fa9a0df97", "value": "6144:NGjOlZjUIjFo2bYl9zdi4+D2OGisQWzoy1Q2xwFV07XXABCkq/mnJJhvMQNIUzPy:NGSFS3Gn9jtbTRun+Gtz4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618944598, "uuid": "f9d8b586-b0dd-4feb-8253-854e4e12f604", "value": 580019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618944598, "uuid": "85b62021-c388-49a6-befd-e8486b2746bb", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944598, "uuid": "8fdf0d82-0258-448d-be68-8a02650ba9d0", "value": "payment copy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cec5030-a183-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618886979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618886979, "uuid": "248214c1-617e-4d59-8ed1-887c57c9e591", "comment": "Malware payload (Dridex)", "value": "e3f3f03325b0c9e54fb75943830803b4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618886979, "uuid": "0e0936c1-2798-434c-bfbe-3ac3822b1455", "comment": "Malware payload (Dridex)", "value": "523da283d65bcf73fa166bfb7cc624de4a1a5d8062cab099f45135176ae2aebb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618886979, "uuid": "633d7613-333a-4145-997c-99bc715dcc1d", "comment": "Malware payload (Dridex)", "value": "5cb55d3e8905af6eedc584a5d606b73ecb4f222c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618886979, "uuid": "58e82bde-4a72-4661-ba97-88debeffa3dc", "comment": "Malware payload (Dridex)", "value": "e880a2206df8e9bc98cb4eabc2013e6bebe3779709b1907131e6152e6d1dc6d0cc6a39edaab8235da8394f4dfe256706", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618886979, "uuid": "f8b606cf-0696-49ee-b4ad-8f2e9015baf3", "value": "61F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618886979, "uuid": "ba591923-197e-4a36-ae96-468e8512ddaf", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618886979, "uuid": "aff90e47-310c-4e76-9a18-ce2812a78daa", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618886979, "uuid": "526bc402-d5e1-4d08-a808-15288e1a3464", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618886979, "uuid": "9bffba21-1855-4ead-8d39-ddd4de6835f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618886979, "uuid": "c5f8e4b3-7fb8-44b7-b7de-ab365f5f4853", "value": "523da283d65bcf73fa166bfb7cc624de4a1a5d8062cab099f45135176ae2aebb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175a0dff-a19e-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618898593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898593, "uuid": "97ecb0e5-89f5-4b8f-ace7-ca3021016283", "comment": "Malware payload (SnakeKeylogger)", "value": "946c89da5db65cb18696066da89c15fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898593, "uuid": "8a497ebd-74cb-428f-b6a5-c5e6b8f89dfc", "comment": "Malware payload (SnakeKeylogger)", "value": "524075f03ecd308e665e2452bebca3cd394a3061a09790f97e96b8655e539c9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898593, "uuid": "45bfc2e0-97f9-402a-b519-fb231bbb2b51", "comment": "Malware payload (SnakeKeylogger)", "value": "70c873ff6167a6f2ceec4b09a29272400a4cfe47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898593, "uuid": "9e92383b-5bdb-4a7b-b873-b2d98f982abe", "comment": "Malware payload (SnakeKeylogger)", "value": "337b33af6cbc291521f84c08d2679782c5d7e2a9f9e64696122bb28710458337da7618a978109502a4cf5edc8c671b65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898593, "uuid": "6f7f8be0-605b-41fd-944f-45f02d87fe7e", "value": "00C423353A039DDBE3299632D41BB348C6DD9C9A11DB36CB7FB8A28C3D55A934A1F404", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898593, "uuid": "2aa40b72-5a9b-486b-ba6e-d8befb07b3a9", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898593, "uuid": "1a87dc21-7afb-4dbb-9962-eb835f23f51a", "value": "12288:b291E7xEsi2UEAFXgkSu9Z8FsGdTzNPV5dce1+HXVtWae:bE1WxE1EAFXVS6CHfueIiae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618898593, "uuid": "5fed724b-5f24-4e9c-b131-d04c5c231082", "value": 550790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618898593, "uuid": "cddb95b2-63a3-45e6-be4b-623d5657d9b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898593, "uuid": "19ef6010-b4e3-4f5c-a5bd-4468372e6d09", "value": "QTY090900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb89697c-a212-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948770, "uuid": "795fa729-888e-4ed1-8cad-9ba5b9579adc", "comment": "Malware payload (Dridex)", "value": "31cdcc25449a1f38e4683ad6d8ac1f45", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948770, "uuid": "6d816ed4-0e0f-4f9e-8f0e-8827f73146cc", "comment": "Malware payload (Dridex)", "value": "5270b6176935bb557697defd22db960db7d89427769b722018f1838952b2713b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948770, "uuid": "1a8d1b0a-b0d8-442b-b88e-519bccd7e4cb", "comment": "Malware payload (Dridex)", "value": "cf9868199346ed5880150888a37ad87b5994bd9c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948770, "uuid": "7dcacc44-a365-4903-8524-5c3aaec9d322", "comment": "Malware payload (Dridex)", "value": "4aa06868cca4646167eaa2e32d388a226ca1b4c599844207fabd91510c3139f870887a48f5231e521326155124606b53", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948770, "uuid": "3ab09c0d-56ab-4243-8a0f-6dd94350a6fa", "value": "45F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948770, "uuid": "6e178821-b166-42b9-8800-63761383ff37", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948770, "uuid": "8c5e5860-3ac9-4902-aa7e-07d70c5403bd", "value": "3072:uwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:uwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948770, "uuid": "520004a9-9eec-4f60-8ef9-8ecfcfb0b9a0", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948770, "uuid": "d6b8eb1c-f255-48fd-8386-a8a0479f29aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948770, "uuid": "19be81f3-8bf0-4508-a930-5f1318b50460", "value": "5270b6176935bb557697defd22db960db7d89427769b722018f1838952b2713b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c1db9a-a1c0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618913227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618913227, "uuid": "28ca6112-7957-40ee-80f2-730acf67355f", "comment": "Malware payload (Dridex)", "value": "63d4007bd93854e3726f067e589843c4", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618913227, "uuid": "667aa8db-8e64-4b76-990f-49dcd5b15e96", "comment": "Malware payload (Dridex)", "value": "527f3497e74186cac2190fe29d39ba7ba1004b60d76c11038329a33dd2d01479", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618913227, "uuid": "fe4271a1-3798-4983-ac15-7d56d6c32973", "comment": "Malware payload (Dridex)", "value": "56a0d636945d6a70bce36451ba2bacd91f8cfe8f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618913227, "uuid": "2e2161b7-379c-4afa-b3b9-7949159d0f2f", "comment": "Malware payload (Dridex)", "value": "06f845eb97c69b109bcfd8cb167c0d4490820a041f6db65b14742e62ec1a0e0ca30fa01f76d0adec775071421dee1021", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618913227, "uuid": "79af47f3-0c86-4254-8814-9b753f8b02d4", "value": "6EF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618913227, "uuid": "cee8ff5b-9005-4f14-9a3c-d01a1231ca10", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618913227, "uuid": "d29d0b7c-7691-46ea-ab2a-5a96e6ceaa86", "value": "3072:Mlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Mlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618913227, "uuid": "9c78715d-2d67-4e5f-9b65-8c5b82dba3ac", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618913227, "uuid": "34d3b53e-c426-4369-aedd-85ca0993dc7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618913227, "uuid": "691d92b3-e598-4e82-a39b-1dd16b3fda44", "value": "527f3497e74186cac2190fe29d39ba7ba1004b60d76c11038329a33dd2d01479", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9bbad2c-a213-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618949197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949197, "uuid": "4862256b-b3bf-4be8-9621-9aa654751df1", "comment": "Malware payload (Dridex)", "value": "ecdaafafbad17e1d96ba641ef56968b2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949197, "uuid": "827e0907-f83e-4812-a57b-e9a478107d21", "comment": "Malware payload (Dridex)", "value": "52b885a0c072b1131850112dfe6783b27ba95a5180f167165930027644d3532d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949197, "uuid": "18ece421-9ca5-4c30-991e-325fe1e189e4", "comment": "Malware payload (Dridex)", "value": "3b1d849450f39ff4e025ce7169808dd326eb31b6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949197, "uuid": "f4c3cbc7-1604-45b8-bc40-955fe6541fcf", "comment": "Malware payload (Dridex)", "value": "02baae733248d5ce09e279530743595dd77519d7ac7c18565e1857c8c48a49e92644c2946dff0bc549142487d036eaba", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949197, "uuid": "fb7d9ca4-81b1-4db0-b519-a7ddc7e98528", "value": "D2F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949197, "uuid": "9896ebe6-1ce2-4f30-957f-e94eb038d39f", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949197, "uuid": "a83c14e4-5a3d-4a63-9add-1a6d80231cb6", "value": "3072:uwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:uwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618949197, "uuid": "6d85e977-3a78-424e-b7fb-4b9d858068b5", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618949197, "uuid": "86912e1c-7852-44da-8c9a-8c9b7b82bb6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949197, "uuid": "9eaf227c-9612-4c4e-bf5d-acfe2d59d2b7", "value": "52b885a0c072b1131850112dfe6783b27ba95a5180f167165930027644d3532d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79755ce-a20c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618946106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946106, "uuid": "4fa8b39b-8139-4ca9-abca-4c7942060c98", "comment": "Malware payload (Dridex)", "value": "8d73c8bdcd0b3839ab4cb56922c16205", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946106, "uuid": "9c3adf54-69a2-4922-8489-ca1fb137e668", "comment": "Malware payload (Dridex)", "value": "52f5764741a02833c7c9f361ffc98d210f8121273e60fda3244d53b963550fc7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946106, "uuid": "ac1fe068-253f-4dc2-aacc-8d533b292d37", "comment": "Malware payload (Dridex)", "value": "3dad17cb461a69641ab391ed43c99a145947c705", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946106, "uuid": "52b7dc1d-29eb-4f21-9ce9-7319ecbdd35c", "comment": "Malware payload (Dridex)", "value": "de9c5800e651e9b1499d97332ec81456b2183005296784256ace621871edb37e904dd40fbb55cb4fbe72df8d0ebf8346", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946106, "uuid": "bb39bf87-ccab-47d0-a6f8-bcbef34d6d68", "value": "8CF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946106, "uuid": "d9d1ebc7-9d7c-439d-b51f-de371e7d98b4", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946106, "uuid": "08757240-cc9c-4b4b-bafb-6afc52b418c4", "value": "3072:nwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:nwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618946106, "uuid": "2dc31af3-a5b8-40b4-9daa-205f5a9c9afc", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618946106, "uuid": "0a05b8c5-0ce4-46df-9611-37db2e45f222", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946106, "uuid": "37e7a610-8efd-4a0b-b4e3-ca48729ff800", "value": "52f5764741a02833c7c9f361ffc98d210f8121273e60fda3244d53b963550fc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd05871f-a1a3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618901072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618901072, "uuid": "fd2450a9-6d6e-498f-bdc3-f2dd39572692", "comment": "Malware payload (Dridex)", "value": "6042284336973d660e19b1b58135351d", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618901072, "uuid": "05f77209-1eca-48f2-9dd7-b6445419b849", "comment": "Malware payload (Dridex)", "value": "5316e082ecf2d4bc292b5d7f560ae297904209cdce3d3dd5f723b5331d8126b1", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618901072, "uuid": "ff64a43a-154f-4e34-afe4-d9f16d02db23", "comment": "Malware payload (Dridex)", "value": "595392e44d7cab1e73e2f4e810a4996b8f52202a", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618901072, "uuid": "c712d751-cbb8-4e74-a840-5d94fb445b1d", "comment": "Malware payload (Dridex)", "value": "6774f423210934f5edfeb1a485734ae532bd4d458a6562566b78209304e32059bf5d111bb25823a63d34fcbd673581d0", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618901072, "uuid": "dccae643-37a4-4873-9ec9-89d1e55b7479", "value": "F3F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618901072, "uuid": "8c1a6e92-d411-48d6-b20a-a88cf0e30ec9", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618901072, "uuid": "4a20a2b9-bf76-41f5-aab5-f616cc52b7f0", "value": "3072:dWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:d42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618901072, "uuid": "c44418f6-a2d4-4235-b566-45e3b7cb02ff", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618901072, "uuid": "a6932384-c6c9-4bc8-8868-4c8459636684", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618901072, "uuid": "634c9619-a662-4869-ae66-a4682ae9b3a3", "value": "5316e082ecf2d4bc292b5d7f560ae297904209cdce3d3dd5f723b5331d8126b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f91d71-a219-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618951392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951392, "uuid": "2abfccc0-6182-484f-a31b-add3e6ab788c", "comment": "Malware payload", "value": "59afa5bc60bf7b9adb7dd4a0df84c0d9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951392, "uuid": "f2784129-36a2-446f-bdd6-649bfcc7e5ac", "comment": "Malware payload", "value": "532e97e0ff4498854440784c6e7bcb8ed84ca654fb4acf893e8255b8a8c37911", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951392, "uuid": "9ee622e4-cc3f-42a0-9209-01bd717868a6", "comment": "Malware payload", "value": "e3aa21d37156ea87d87ccbd011cf84896621b572", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951392, "uuid": "fd2f9a2c-2954-4bd9-b033-14a3810c36a3", "comment": "Malware payload", "value": "dfaa3ea44da49debec7208c8d996eb06fc117dae2ad3e6bf3a3a4daf503f48ef9e062eaccf991dc1d8e68b022babef58", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951392, "uuid": "559b9c70-8d5e-4b05-a948-4e6d8ea5eb91", "value": "1365126B47938BC6C0817FF8597DD37E8F3E9DB4F863898C12789CDD6A4A48116C8612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951392, "uuid": "d29131de-91eb-4521-82ab-c9d58ae7290e", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951392, "uuid": "330ba46f-7a77-4df9-b6dc-ab1427fa805a", "value": "24576:T4pCbcwQbbC+/bb2GRrILR4IKz/L5uqju6u/kKxmgMfBvOoUSd3GdrwSRHIp:UpAnhalMRLKLhjtu/3xm3GzSdWdVHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618951392, "uuid": "330bf30d-5d99-4fb3-adf5-839d7965b888", "value": 1504764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618951392, "uuid": "c64c2a34-4df0-4901-8e51-7828817d170c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951392, "uuid": "b236fb45-e640-429d-95ef-530264faf982", "value": "532e97e0ff4498854440784c6e7bcb8ed84ca654fb4acf893e8255b8a8c37911", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60eabc6c-a1d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618920621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920621, "uuid": "d370ad81-192a-48d7-8673-5ad0e870067c", "comment": "Malware payload (AgentTesla)", "value": "5c7b15423ace98c0fc4357a9ddbf0b13", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920621, "uuid": "55e1f15c-7425-4fac-8d79-9cf00aef9761", "comment": "Malware payload (AgentTesla)", "value": "535fc42d2f30f39926f25da2b11211c6076ce166c1389df0419db06a3432b852", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920621, "uuid": "705567a8-ecff-4f30-91b6-519aca7c4c0b", "comment": "Malware payload (AgentTesla)", "value": "9b2e1cc2bd264a6319f7d615203866f93ff6bec6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920621, "uuid": "7847f30e-60ed-4253-8ddf-55d8920371c7", "comment": "Malware payload (AgentTesla)", "value": "1d569d23669a65f67aebb073983502e87a8ee24221263787d095f9a11ca8b5dd390c43930a53c7859dea5d953afbac79", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920621, "uuid": "7cd0b681-1657-49cd-aadf-d1aa0e7974b7", "value": "0FD2E75A50507149D5E7097538AAEE303B38A3718C81A20EE4A6515CCF827FE78EDDFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920621, "uuid": "0be7c710-a90d-4189-aa7b-db0f654726cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920621, "uuid": "16ec413b-4b2e-46fc-902c-5ba5b6370957", "value": "384:+mZJtj7KLRMK8z/8PKQAZcJstfftHJTWi7wV4uZG2wnwvETAUDWh4:Ptj748z0yQAZysFfR7U0wiqh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618920621, "uuid": "dc96dd44-ed17-4d66-9bcb-017af0d7d75c", "value": 30848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618920621, "uuid": "1c47d382-e9de-4422-b189-a84802643c16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920621, "uuid": "ec4e062a-6c2b-4529-a161-16fca5c859f9", "value": "5c7b15423ace98c0fc4357a9ddbf0b13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fa203a-a20e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618946781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946781, "uuid": "f64f2988-c168-48a3-95a2-4c19d9610677", "comment": "Malware payload (Dridex)", "value": "b4551d7801bf855b62ca5ec59915c177", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946781, "uuid": "e9add801-615b-4369-8f9b-dcf3024d7c32", "comment": "Malware payload (Dridex)", "value": "536aac01e261f35387aad67d6e8811b24e50b6e4dfa828d14e0009803a2d93ef", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946781, "uuid": "e32963d5-2b25-40e8-81d4-cb0c71284168", "comment": "Malware payload (Dridex)", "value": "eab631854b0d42a9e42ebeeb7848630f3917f848", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946781, "uuid": "e95efdf0-a14f-405a-be30-3206d305af5e", "comment": "Malware payload (Dridex)", "value": "ae376e31d311fd78ed881bea4722a8f2fa9d6311b70d2c46dc09f6a21fb6e4c4f6259a5a3150c5868e9a7e105bf6cf1e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946781, "uuid": "052c12ca-219f-417a-918f-9d026838e81b", "value": "E2F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946781, "uuid": "6f30c9f7-676b-432a-8db4-5e591772ceea", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946781, "uuid": "df0b982a-9089-4caa-8361-beedf4f50e0a", "value": "3072:LwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:LwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618946781, "uuid": "d35a0185-b92e-41bc-8593-713ffd4d428f", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618946781, "uuid": "0ded3e62-9f08-4713-9cd2-8175a8d5c2c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946781, "uuid": "ac9694a0-de74-4cdc-935c-7678c627b490", "value": "536aac01e261f35387aad67d6e8811b24e50b6e4dfa828d14e0009803a2d93ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964aba57-a199-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618896658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618896658, "uuid": "a862853c-9081-4241-bdc3-9d4d1313a4e0", "comment": "Malware payload (Dridex)", "value": "faa1d202f40fdc1e39b8984a5bc1157d", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618896658, "uuid": "89925fe0-a3ed-4c01-b1a0-70bc12d98c1d", "comment": "Malware payload (Dridex)", "value": "5373421ffc8659aacb50c444a2fc53a72166a4580080b1207cf5f9526e749991", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618896658, "uuid": "1cd5eda9-6b46-42d6-9455-c864cf974961", "comment": "Malware payload (Dridex)", "value": "6616e6802419b84fec839cc55ff62fd1539f3ff4", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618896658, "uuid": "50cf336a-48e1-4088-bcc3-4e62e1b169e9", "comment": "Malware payload (Dridex)", "value": "7bcec7377eda8533c0b530918f9d999e33f8853fee475aef69523aeced662625a9de26dede82dbc5081982d587ddd403", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618896658, "uuid": "546e1b23-1723-4100-90a9-77b3e6cd8de2", "value": "4A159D113681C03AD5721A318D25E6F909AEBC218F318ADF77D83F6F6B356C14A32766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618896658, "uuid": "b6f96d8f-cde1-42bc-9779-e5ee330cd11d", "value": "dc93d67ad7943a17151bf2b40b7ad960", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618896658, "uuid": "413d095b-8415-44f4-808f-7f1453c727c0", "value": "24576:dCwP+Jzkw1zr1ClPHFvBpjcSfBPK+9vRC72iQMpv4Ny6CCm4qyV:d7+Jzk20lNvBpjcSfBP79vRmfv4NjCns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618896658, "uuid": "e358b952-e8ba-4f50-aa74-ad936fa7c06b", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618896658, "uuid": "7d3224ed-b731-4f38-a5e7-2a172f8d7758", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618896658, "uuid": "7a6a95a0-2936-46c0-8dbb-22e37b64d999", "value": "5373421ffc8659aacb50c444a2fc53a72166a4580080b1207cf5f9526e749991", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f90e3b-a209-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618944599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944599, "uuid": "5ce906bf-f360-4ee0-a976-61942022d18f", "comment": "Malware payload (AgentTesla)", "value": "7040850c5f29b143eebfe32b97a97ddc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944599, "uuid": "5a62175f-c920-44b4-b60b-6112ed26dccd", "comment": "Malware payload (AgentTesla)", "value": "53947cdc6ca591ccc866933e6d69a6861160325956ae0a284bb5d222f933e08e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944599, "uuid": "8c649a7e-c0e6-4e8f-9fdd-ab55d6c4d7f6", "comment": "Malware payload (AgentTesla)", "value": "20c428053d7d83ce23e7d6f3c48c4cd50e606ae3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944599, "uuid": "19e893ee-722d-4a21-adfa-32d19501d53b", "comment": "Malware payload (AgentTesla)", "value": "e662cac6e2a260cc59e51a3cbce582ddadcf435b26e5095ff0fa4ec969478488c06ac6ea07b80a8813cf7657f70df980", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944599, "uuid": "9a099e02-9d87-4af7-8cad-b85b65e2945c", "value": "4FD4BA9CC48742E88F85ABB82B1F2F85114C7B6EF744A6327234977527E2C7B901697C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944599, "uuid": "f6cb2306-72e2-463a-84da-3a0858d7c285", "value": "6144:zFdcy5mAttQ+GIdGSKsUHccH67oPD4fU0sS5IWOpRHz2SZ9BfyZt2mh6SlRPpJaK:3Ug6wzGht59vA8AnCQiQPeteb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618944599, "uuid": "3293aae9-34f4-4729-98f6-cbbd39998f27", "value": 643882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618944599, "uuid": "c7b5204a-3f67-40dd-9c79-58bbc1dd9daf", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944599, "uuid": "f427a316-9abb-4efb-99d6-5a63db24a351", "value": "FWREQUEST FOR URGENT QUOTATION RFQ.doc__.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77968538-a225-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618956736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956736, "uuid": "856e1c8c-5301-426b-9086-944820cdc41f", "comment": "Malware payload (Dridex)", "value": "5b6ac34cf2f36a8047c17ed489b820f6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956736, "uuid": "e113ddc8-53ce-4a4e-a9c8-23a59150c7e7", "comment": "Malware payload (Dridex)", "value": "5398d008801e6c189fa05253f912d0434d663478338db7a4aa550b9219f49e9d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956736, "uuid": "e4e958ed-8ef2-4258-be65-3c9d0ad77909", "comment": "Malware payload (Dridex)", "value": "cd95b9083ad2bc73b8240f233362891f8b0da109", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956736, "uuid": "61e3d316-e8e0-4e77-8fd7-ca263a9fc0f9", "comment": "Malware payload (Dridex)", "value": "567fbe4fdf5a3b08bf3f8b0cd7498dd8e9bd25ada182b819a6eb2849c151fd5115f6dec7e4517df9df8ac66da08139be", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956736, "uuid": "2fa6c141-bb93-4d55-8406-246f1e3bd1ed", "value": "F7F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956736, "uuid": "e8ae4d69-0412-4cde-95b0-6a48a38d0959", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956736, "uuid": "ae70d621-7f04-4271-86b7-3da65c7e525e", "value": "3072:QwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:QwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618956736, "uuid": "e9e232ca-334d-4d8c-8b6a-550838215875", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618956736, "uuid": "b16c043c-55a1-4c8f-b317-d24c2ebaf869", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956736, "uuid": "867a4bbc-3594-4111-a2db-301c55e5eaf2", "value": "5398d008801e6c189fa05253f912d0434d663478338db7a4aa550b9219f49e9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a16774f-a22d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618960230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960230, "uuid": "bc3c0309-658f-45ec-9b5d-54c4517b7632", "comment": "Malware payload", "value": "79868a9adcd3ea961abc8824e39dc8cd", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960230, "uuid": "bad5f5f5-3453-4cc5-b036-309116539048", "comment": "Malware payload", "value": "53a6a1feb8ec41bdc09de842d86368936d3e1f9c364620c0c7629fd1c5b3286c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960230, "uuid": "3d7620de-8680-4f8f-b483-1867b28be2eb", "comment": "Malware payload", "value": "3140e5ddf0c2209741f5aa34b9b023203515a357", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618960230, "uuid": "bda27f5f-b663-452c-8fbb-c111c847ff9c", "comment": "Malware payload", "value": "0d1862f47ff4c9971fed7eddf927405c3bc14893ac04ff78dcc49635c8d4d64045e5ef3e3e1c643edd073b93acee270c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960230, "uuid": "a50b65d8-4145-4c1b-b27a-8964f03338b8", "value": "45F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960230, "uuid": "663f4d7a-6925-4560-a443-1d66a5e25914", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960230, "uuid": "12e37474-f340-4882-a55c-36033c706f8b", "value": "3072:awZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:awZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618960230, "uuid": "884a1cd2-f8dd-46bf-ab78-d69f3eb2cec5", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618960230, "uuid": "0d753b9e-4563-431e-a17e-ff697bcc4d7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618960230, "uuid": "80d0f4a3-f216-4b36-8ab1-bc5c8974160a", "value": "53a6a1feb8ec41bdc09de842d86368936d3e1f9c364620c0c7629fd1c5b3286c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52054eca-a217-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618950660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950660, "uuid": "8d7ad188-102c-4b2a-8b4c-ed681dfc3413", "comment": "Malware payload (Dridex)", "value": "8b5e306410875f1eb2cb5adfd92c3d52", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950660, "uuid": "45918ef0-c741-4730-a771-cd07138bf2e0", "comment": "Malware payload (Dridex)", "value": "53a90dfcf79f3aa8049c3a37c0f82e262d9c1ceb31de21b0178be0338a21feb4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950660, "uuid": "04700902-1ca5-477b-8b44-0bd9df6ed9b7", "comment": "Malware payload (Dridex)", "value": "b6f9d68608937775f04eae880d5bbbdf75725ab9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950660, "uuid": "0d00c94f-5fd6-4140-9736-60049c1e48d8", "comment": "Malware payload (Dridex)", "value": "3a66bf8721367d653111ebf741c5b62ad7a00d585dd950a1466141476908c7dd4e81c32061323d0bef195a5b064439d1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950660, "uuid": "dc1ebacf-50d4-4dc6-8192-86976802f348", "value": "E9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950660, "uuid": "39bf3af6-f20c-491a-aea4-1b952ccb5d17", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950660, "uuid": "a7af1095-2531-4541-aae2-1fc7516efd17", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618950660, "uuid": "a71024cd-52f2-4344-80c3-877ca7861f0b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618950660, "uuid": "25913433-08fc-42f6-bf87-76864bd04097", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950660, "uuid": "1dac725d-2d0c-423a-be46-5bebd41ad4fa", "value": "53a90dfcf79f3aa8049c3a37c0f82e262d9c1ceb31de21b0178be0338a21feb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7bf4ca4-a202-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618941812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941812, "uuid": "479ed969-9188-42da-9be0-0e6eaf018a48", "comment": "Malware payload (Dridex)", "value": "7a2392b0b6a80317de22cb83da2eb16d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941812, "uuid": "25ebcbb9-2688-4f3c-abfc-58a0fba3e632", "comment": "Malware payload (Dridex)", "value": "53bcc9adefa910357bfb3a54b1e13ea869195dbefaf83ec1194482b9840270ac", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941812, "uuid": "192167dc-c918-4df8-afc3-21c484c2d454", "comment": "Malware payload (Dridex)", "value": "e8ea431ae5ba7e9eb47272f3bb3a18c46b2c8b10", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941812, "uuid": "353da542-b237-40de-a170-4a4a692cf0bc", "comment": "Malware payload (Dridex)", "value": "dbdabfd15a1caabe2e14a290c8ec613433e66972ae86d1485bc6b1310ea02865354f1305c40081a608e9b0c67397b1ba", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941812, "uuid": "5e565933-24db-4050-bb79-6b450737208a", "value": "F8F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A50DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941812, "uuid": "5306c80b-ad08-4808-bf3f-004e243e834f", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941812, "uuid": "9ac9db6c-72a0-46fe-ae03-a2132201e572", "value": "3072:owZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:owZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618941812, "uuid": "c262602b-11c7-476d-8f4e-6cb0f66a8d4a", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618941812, "uuid": "987fa562-512c-44e4-9e16-9d5b002e8acb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941812, "uuid": "da81558b-367d-40df-b042-aef574f37f91", "value": "53bcc9adefa910357bfb3a54b1e13ea869195dbefaf83ec1194482b9840270ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93264c98-a224-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618956353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956353, "uuid": "d7ddd35f-d02e-4ef2-9ee2-fed2428c0cc3", "comment": "Malware payload (Dridex)", "value": "90797a2af2e0d99accda478223ff19b8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956353, "uuid": "48846a6f-aa9c-4731-92ee-979ae25a86d5", "comment": "Malware payload (Dridex)", "value": "53cb259353d59c4c7fedbef962d6e972cc5d3174afe8f37fc93238ca13a2c87d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956353, "uuid": "9c367cf0-fa76-4689-a072-fa2efdd41822", "comment": "Malware payload (Dridex)", "value": "971a18d66bb7228475120e0d7dcaec16d1889a6c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956353, "uuid": "b930fb53-6cca-4920-a9c5-314e7ec3b030", "comment": "Malware payload (Dridex)", "value": "8671227785be155fe4b21379baf697bd3ffd92064b1682b1feca255e55a61fd7d93270d3df3fb2d3f90efd7b2c562119", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956353, "uuid": "af792f4f-f673-49f0-a607-5bf17eb341dc", "value": "23F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956353, "uuid": "7620aaad-0283-4467-9611-d0d62fdf662a", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956353, "uuid": "fe3dfcca-c0c0-49c7-a0ff-c370ed8d0ed2", "value": "3072:ewZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:ewZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618956353, "uuid": "663c90dc-885e-4b1e-9d45-2aa88f040d24", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618956353, "uuid": "1c663465-d657-476d-9fb5-ff6b3722c340", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956353, "uuid": "6d547894-74c0-47ba-9af5-0918f394d260", "value": "53cb259353d59c4c7fedbef962d6e972cc5d3174afe8f37fc93238ca13a2c87d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad3b125-a182-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618886761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618886761, "uuid": "afe26060-e042-42e9-adfb-71325f77981d", "comment": "Malware payload (Dridex)", "value": "d68cd2b28c97ee43ee805117e836ebfb", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618886761, "uuid": "ad124035-8164-416f-baee-dde953e9e85e", "comment": "Malware payload (Dridex)", "value": "53ce12533b2a4e021ce28cc62fef6daea4d46f21cfec1ba13947dfd57796f43f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618886761, "uuid": "c4e96b2f-7050-4dba-b5b5-1abcb4040ce2", "comment": "Malware payload (Dridex)", "value": "4efc128294c90a259e7812061b8ce495b4344c3e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618886761, "uuid": "bd1c3fba-d533-4ee5-ada5-94f18cf084c5", "comment": "Malware payload (Dridex)", "value": "916d076ed1314e45beb70df50a9d6fa5490af745353586a7d443f688963fb71db143e74698093af676041afffdadd7c9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618886761, "uuid": "bad098e2-1c96-466d-9794-99dc0afa552d", "value": "27F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618886761, "uuid": "f35aaba4-feb8-4a52-a9fa-c283b756e1a0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618886761, "uuid": "8c691508-28e7-430b-9b67-fd971ace6cdb", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618886761, "uuid": "f107b3fc-2ea8-4997-8342-a19cba25353f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618886761, "uuid": "0aecfc81-8505-4831-a453-f958891754c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618886761, "uuid": "cc0cb5ca-0e6e-417f-b92e-f91668c9c8f2", "value": "53ce12533b2a4e021ce28cc62fef6daea4d46f21cfec1ba13947dfd57796f43f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b04b97c7-a1cb-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618918177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918177, "uuid": "6dd780f5-803a-472d-9415-6a4f8f81114b", "comment": "Malware payload (AgentTesla)", "value": "3d7eb60c4dc9bb4682cc96d9598489cf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918177, "uuid": "9f954451-28a6-41da-9465-f80a4c6eadff", "comment": "Malware payload (AgentTesla)", "value": "5411c267e70b321e6444f820ff6b5921eda7d363f62755b1edd2af4e6d4cbae8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918177, "uuid": "74de7726-a884-4bbe-b48c-5c823a521567", "comment": "Malware payload (AgentTesla)", "value": "1edf73c2456240637c4d074cdb3e052b8e60e299", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918177, "uuid": "1a55f6c0-b75f-4e58-adb6-e621d1206b3e", "comment": "Malware payload (AgentTesla)", "value": "f1bb23868742548678b909b474cfa778393164a0b7469f1b63398f95367778f9d212efbeb558108d91bc7658f2e9c9fc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918177, "uuid": "d6dc8684-2de6-4e2e-80b2-9beb0d90cf50", "value": "5C62CF1055C91ADCE6EB9BFE3E8390EF8A12EC609D29736315DDB449040DCCC855D89F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918177, "uuid": "b633b948-a8a2-4bfb-ac06-33f5c6328d44", "value": "384:U3zmGXhBbGdVSXhBMzOSIgD4Y5KGBEKvKdghF7xZ3keLZIdaNhhUNV/Gu:wmQhA4rmIgDh5KUyQtIeLZqNlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618918177, "uuid": "fd458955-ee07-447d-aef6-3f639c7faeac", "value": 15966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618918177, "uuid": "75e82ca1-78f5-4d6f-8e95-a823a4f33b93", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918177, "uuid": "8f94abc1-b6f1-42e8-9b8f-a3868dc8d68f", "value": "ERICO DOCUMENT 01.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c635d92-a21a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618951939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951939, "uuid": "de5d3b33-9672-4aeb-8abe-f800b009d505", "comment": "Malware payload (Dridex)", "value": "df3caafba0a8d10d71c3b197a8aa9b44", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951939, "uuid": "84500e75-37a4-414e-8e8d-6cde3344ed53", "comment": "Malware payload (Dridex)", "value": "54550aeed242d939fc507183da5e02f288e059682f3d2975f9815b98b4b226b0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951939, "uuid": "6e03742b-6f71-40b8-b3a1-f1eabd2dd061", "comment": "Malware payload (Dridex)", "value": "0114da46d14883a321309f0a2e1a4dcf6c492353", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951939, "uuid": "41f9c2a8-6a06-428d-a119-ce5200b67795", "comment": "Malware payload (Dridex)", "value": "e01d950398531d4e56a5295537f3a8e58abb16576163c22af273832232a02844ade870a73bc2dc725cac623856771b6b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951939, "uuid": "cfe6be8e-49b4-423e-a957-fe67607fca32", "value": "88F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951939, "uuid": "9e57c205-ff9f-4c45-ba2d-79c242e8298c", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951939, "uuid": "085fd275-33d1-431a-abc9-9a13478304c2", "value": "3072:NwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:NwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618951939, "uuid": "f92c3cdc-c9f1-4ced-ad85-0a67c547c1da", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618951939, "uuid": "379c06c2-1a5a-4ecf-9e72-f7eba4f6f335", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951939, "uuid": "c6479c3a-9c3c-4e5e-9c89-4085d169d6fd", "value": "54550aeed242d939fc507183da5e02f288e059682f3d2975f9815b98b4b226b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a1856d-a174-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618880608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618880608, "uuid": "150e311e-79d0-467f-9b75-a4453926567f", "comment": "Malware payload (Dridex)", "value": "bc74c1aee34bcdff99285584fe17c377", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618880608, "uuid": "1d148510-54dc-4268-bdd7-26cb27222b70", "comment": "Malware payload (Dridex)", "value": "549f31c71da39f3ca610ec0213a70a728d963d00d326acb0e5544edf718cb2f1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618880608, "uuid": "6cbb44d1-44a6-4d11-a9ea-61760f53e90d", "comment": "Malware payload (Dridex)", "value": "d30dadc2eb68b5283ccbfdd4aca3497b21241201", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618880608, "uuid": "2e1eb2fc-e3d3-4e20-9467-75a5e556791a", "comment": "Malware payload (Dridex)", "value": "14133f6706a355fe643f0e73057efc41ff231e3e5a8850796a4f41762cc30faf36b52c65d803d280ef4c987dc158e932", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618880608, "uuid": "2175e33a-f17b-4404-a49d-3a402c33df08", "value": "D3F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618880608, "uuid": "6a6bf109-1c0c-426f-ad65-10ae8585c516", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618880608, "uuid": "4c757b6d-09bb-452e-bbc8-f12bd9bc2ead", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618880608, "uuid": "261848b3-9eba-48cd-87fd-b2efc96d8958", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618880608, "uuid": "ac945b9c-10e2-4527-ab78-23b52cc6c2e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618880608, "uuid": "fc887469-f949-4b6d-b53c-4d82a80e49c6", "value": "549f31c71da39f3ca610ec0213a70a728d963d00d326acb0e5544edf718cb2f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9e4eeb-a223-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618955780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955780, "uuid": "081685a3-7f93-4210-8821-26fe54326780", "comment": "Malware payload (Dridex)", "value": "6e63cd37f88c7fd79bbcb56f9133632e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955780, "uuid": "5774a583-4ce8-4865-9f1a-b9acade21b70", "comment": "Malware payload (Dridex)", "value": "54a01da0539521059861f36d7c777fa93ee041f9fc1671f2bcf55b3b502a66fc", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955780, "uuid": "94bfbf2b-f4e6-4885-a9a4-70103bd78b74", "comment": "Malware payload (Dridex)", "value": "0d249c7a5abf82d00bc0d19bc890275212717293", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955780, "uuid": "a064d690-b7c4-4e80-a250-bd61f0c27706", "comment": "Malware payload (Dridex)", "value": "a1edc66ad7b5de4ef08613025577ccd1b4b5527406dbac66c27518bfb73cc1b2da8ddda61f786a023e420f09d105c533", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955780, "uuid": "9040fd06-a3b1-4eed-b03b-ed3a3c73a75e", "value": "6AF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955780, "uuid": "dae01e34-5200-4793-899f-8f8981419005", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955780, "uuid": "f92c8b5b-b41d-45fe-bf34-e675075b07a1", "value": "3072:nzwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:zwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618955780, "uuid": "8d89196f-1936-449f-8515-695f8ff62acc", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618955780, "uuid": "aa0d0f9f-aefd-4acf-b52e-7352b5023be3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955780, "uuid": "8426513a-c14d-4b80-8b5e-3fcde8e29a33", "value": "54a01da0539521059861f36d7c777fa93ee041f9fc1671f2bcf55b3b502a66fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c238e13-a197-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618895729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618895729, "uuid": "d4d50549-e0bd-40e6-b4ae-f77108b6d62a", "comment": "Malware payload (Dridex)", "value": "d1901fdb372c702773ba35c2933bfaf8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618895729, "uuid": "dd1eb415-9d49-48c9-a9a5-880709bb9d0f", "comment": "Malware payload (Dridex)", "value": "55536541758b7fbaa69ef186932b8f23da5207be2c01d85f404329180c9100b3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618895729, "uuid": "82c9d493-4948-4591-9083-dca7ee9102b1", "comment": "Malware payload (Dridex)", "value": "e9bcc5ecd9cec20aa1dffef097b7337dcfc00ad2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618895729, "uuid": "c6da7e33-c9cd-427d-8561-ac5bdfbf38b4", "comment": "Malware payload (Dridex)", "value": "22f2ea657dea7c7565c6379c1292bb3ea89f5e722e5e346e2728464c6857f634f2172f43ab8b384787925002ee65225f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618895729, "uuid": "a45f3dc5-c087-459b-a292-25e774259948", "value": "3BF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618895729, "uuid": "efd8c75b-302b-462d-9189-b4b09108d6cc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618895729, "uuid": "9aa70987-3bcc-42d4-ae2b-2b0f9814d820", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618895729, "uuid": "d67d20c9-b0db-443c-873b-9063aa9e624a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618895729, "uuid": "ca3e39a9-8ca7-4b5c-9058-05d8d3a3536d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618895729, "uuid": "1935f3b9-2bc9-4ff1-8b96-f2261c1ab0ab", "value": "55536541758b7fbaa69ef186932b8f23da5207be2c01d85f404329180c9100b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9be03b8-a20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618946647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946647, "uuid": "b0b4ea2f-16e1-4975-b409-506463f244de", "comment": "Malware payload (Dridex)", "value": "93f2b72e3060c874e5ca141457bbdd03", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946647, "uuid": "0391470c-bd10-4aa8-bdb6-558314da6871", "comment": "Malware payload (Dridex)", "value": "555757788bed3aaed348ecdb2389eafd2e51da6a15885699380236a740028915", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946647, "uuid": "0ab30fee-7a06-4fc9-83c5-8a8eda62c849", "comment": "Malware payload (Dridex)", "value": "d4bbd81bf9d154296c8deea3e09499e2e06c6732", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946647, "uuid": "34d54c37-f632-4d56-8023-627ce4e47656", "comment": "Malware payload (Dridex)", "value": "db9804881906d1d28741a853dcba59ffb5efe574117c48fe84d665f79b93b77e8b9ee3a4a34c8d9e49f27496e7f2f1f3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946647, "uuid": "663ba590-de13-41d1-9162-d3b315be2952", "value": "A5F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946647, "uuid": "9e1f8ce5-bc50-413f-8451-25354f339334", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946647, "uuid": "2725ec70-9167-400a-b0a8-5076b2281fef", "value": "3072:awZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:awZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618946647, "uuid": "7a22e964-41d0-4ac4-a4d7-0e7b4596bb3a", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618946647, "uuid": "a53cf6c5-ca38-4953-8e9b-01b48b59958b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946647, "uuid": "e134abf2-807d-45f6-8a06-b93cc8bd2ea7", "value": "555757788bed3aaed348ecdb2389eafd2e51da6a15885699380236a740028915", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15cdc443-a20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618946264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946264, "uuid": "b2fa7fab-8972-4175-84ef-8b34d8bb80ad", "comment": "Malware payload (Dridex)", "value": "17a1456de8d68679fb536a6c994c4aae", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946264, "uuid": "760d8d77-0644-4524-a562-bdee14023da3", "comment": "Malware payload (Dridex)", "value": "558b659fcfe7bd4c9d3e7968e897a5b6695a83c12d3503ad00b11b9ba929a353", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946264, "uuid": "0c8aec11-db54-4dff-af82-40e86541ab3c", "comment": "Malware payload (Dridex)", "value": "8513b789b57677acc479543e4dacc88caf450e6a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946264, "uuid": "c8ec4651-71b4-4209-be37-5b56aea87f78", "comment": "Malware payload (Dridex)", "value": "28e3b9b6e0dbf31c30093d7e9e3ea00a219a2ea1933d7c10c980d9cd4e324c8bd005efc77390e15db3d68483659c5f33", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946264, "uuid": "11a07ce6-33b2-4f05-9867-f384da52a8f7", "value": "06F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946264, "uuid": "ac5fb606-3b99-48a5-9326-a05444521321", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946264, "uuid": "69124363-14d5-401b-8b2b-b5bf359c2ee9", "value": "3072:OwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:OwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618946264, "uuid": "dd086e55-0a52-4e1f-ad3a-198bbde7796f", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618946264, "uuid": "030e4007-c356-4e8e-9d2b-1772ff319a8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946264, "uuid": "445d028c-f051-4a38-a6cd-b7741394a188", "value": "558b659fcfe7bd4c9d3e7968e897a5b6695a83c12d3503ad00b11b9ba929a353", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb73dd68-a1da-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618924745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924745, "uuid": "cf43437a-0b18-4bd7-b926-97ccbcd745ea", "comment": "Malware payload (Dridex)", "value": "1b0a0c35db254b0762a2c0b06270aade", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924745, "uuid": "9df62f3c-7f7a-48ba-aeba-10489f034a96", "comment": "Malware payload (Dridex)", "value": "559990396d91ab7cc8f63f3c99449ed2efb7f46aa0b2070d02dee2ec3fa248d4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924745, "uuid": "9b50b512-b789-4922-97b7-fc6ca458a9eb", "comment": "Malware payload (Dridex)", "value": "b6295e1e2f88bcf2a2ea486d851b906c39373741", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924745, "uuid": "2abcfbc7-c763-46bb-bc03-e419e74c80a7", "comment": "Malware payload (Dridex)", "value": "98bdd0230d77340df2e076d672c5512f497b8885a532bf555ce4cb0edb623b783f9eea8664e3ab5cc77c76221b1779bc", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924745, "uuid": "18d715f5-065a-4925-aa03-70bd4f5150fa", "value": "5FF3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924745, "uuid": "10d20f68-042e-4e37-a6d0-70c544af97f2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924745, "uuid": "50feeec7-89e0-41e6-93cc-e37303f53a6d", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618924745, "uuid": "8a28b385-94a7-4204-8ed1-6c10d6b418ba", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618924745, "uuid": "f98a3e2a-b12f-4509-b1a5-fe671db1ab5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924745, "uuid": "85af5ec9-ff63-4236-b48d-ba756871c994", "value": "559990396d91ab7cc8f63f3c99449ed2efb7f46aa0b2070d02dee2ec3fa248d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ae1f77-a208-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618944300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944300, "uuid": "fb17aae9-cb91-4ec1-8f42-9069c4b037d2", "comment": "Malware payload (Dridex)", "value": "a7605c475f5b87810e5dcec47c8497e8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944300, "uuid": "760b8a3b-2702-483d-a54e-7cf883ac7d36", "comment": "Malware payload (Dridex)", "value": "55e7175e68515e1749368b87aefb6f1344d894b85622311475d815be65d75715", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944300, "uuid": "f984790e-3b33-4e75-a525-5031e34f9bb9", "comment": "Malware payload (Dridex)", "value": "2ba779e00f4199b84e72737da8bdf975a79b671a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944300, "uuid": "73204168-e771-4fb0-b9aa-ca5e1ff96f48", "comment": "Malware payload (Dridex)", "value": "65162b3ecb52b510b25a3b0743be179dde3332e75513e67b3b2d07bf41b1b151f5fe5dd16d67fa3494cc8790862c95aa", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944300, "uuid": "f9ce3aee-379a-43c5-b29a-42f5b25b3e1a", "value": "86F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944300, "uuid": "08325272-c9a2-4231-af8d-a69ac6f7c0bf", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944300, "uuid": "fdd1c0db-dbeb-4c94-817b-92013ed24206", "value": "3072:LwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:LwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618944300, "uuid": "fd1f3092-f377-4490-b173-9d686ebe8174", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618944300, "uuid": "f6335de1-c663-40a5-bd7f-4dfae8ce42c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944300, "uuid": "18e2194e-122f-4863-bc77-6a765bed1fa9", "value": "55e7175e68515e1749368b87aefb6f1344d894b85622311475d815be65d75715", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b49bb3-a21b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618952465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952465, "uuid": "6c02b6bf-cc3e-4421-8c00-5e20725ddbd1", "comment": "Malware payload (Dridex)", "value": "e9f87a63fc5d7acf1ae3688e4ea58616", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952465, "uuid": "2bc5dd68-88b0-4e99-b234-b693e53534eb", "comment": "Malware payload (Dridex)", "value": "55efbf3c3aeb4d1d5217053b445bc5e06baae209c3088c83acd75172cd7fe65d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952465, "uuid": "dd5f7899-f9e0-487a-939b-a45822b65029", "comment": "Malware payload (Dridex)", "value": "c074e79825ff5ea264664010b61a77da34dfa8f8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618952465, "uuid": "02c2f731-a02a-46e0-a024-96edd79321d3", "comment": "Malware payload (Dridex)", "value": "f1d1227d99c395cd062d4958c7c369592d4618192024a1c31578767d2fcdd59353bccdf1a50e1efb537fbe8800c7f727", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952465, "uuid": "9ace7c9e-6bae-49d8-9620-e5b113dc85e0", "value": "8DF3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952465, "uuid": "fcea4bd7-d25a-4a63-8a39-1bc514b139a4", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952465, "uuid": "9627ab53-7e06-4502-9731-1e63404326b1", "value": "3072:OwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:OwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618952465, "uuid": "e404a32e-bce3-49a8-ae8c-9d061dfe5c51", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618952465, "uuid": "e50a3c98-92de-40ce-ae66-8c5581de191f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618952465, "uuid": "12f7c9f2-1af4-432a-a179-b5239b142ce9", "value": "55efbf3c3aeb4d1d5217053b445bc5e06baae209c3088c83acd75172cd7fe65d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e559ff50-a20b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618945754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945754, "uuid": "d1cb645f-f65a-48be-b911-b8d93d7bd9d5", "comment": "Malware payload (AgentTesla)", "value": "5e2e7fcc11bab293eba6ec68363cd6cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945754, "uuid": "be3428f9-e5c2-468b-b7e7-b112baa78379", "comment": "Malware payload (AgentTesla)", "value": "562d9a4326e09ecb7f988355d1d56c39d025f292c3d3e8a5e319a3ff2c44866d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945754, "uuid": "63a1aa28-bd2c-4a04-9517-4c8a43a0320f", "comment": "Malware payload (AgentTesla)", "value": "c414d83a88d601abbe7d8bbe8eafde905be329ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945754, "uuid": "9ce3ca26-9b37-40fb-a8ad-d8b97235a8d7", "comment": "Malware payload (AgentTesla)", "value": "2eff761a6231c1720bbcf9224275ee6f2c6732cbe51fb9cba59a3d00b54ca9e9c71ad6090dc93e918c6d18e0aa31e4f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945754, "uuid": "eb5d5287-b966-4e35-8ead-a16d88fe6a39", "value": "F9E2F96A51A17519E59308342D55E9743F2C673268C0E10FE862815CDF93BFE78EC8EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945754, "uuid": "030fd9f6-a5e6-422c-b19d-82e430a7150c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945754, "uuid": "c0e2e056-69f4-4a13-8f62-c6a96eaabae2", "value": "384:HeAgpXmTqLw39tSdv4VjH7QKWcO8WKWRlNI9C2LPUR4KyCiyMcm0NU8hEFu:+AkmTl9tSdw2KBGLYxz/KyHJb07hE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618945754, "uuid": "ef199e5c-c426-46e8-b63d-918607e2a1b5", "value": 32944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618945754, "uuid": "cb51a5e1-6364-45c4-8da5-5aa0832c36ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945754, "uuid": "7ad5b8f2-9a1d-43b3-873a-6bad2a621267", "value": "5e2e7fcc11bab293eba6ec68363cd6cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a35211-a1dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618925885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618925885, "uuid": "94ed1ba8-687d-4d39-893f-ef925f6ecbc2", "comment": "Malware payload (Dridex)", "value": "95aa469573a4603db6d44ec87d87f235", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618925885, "uuid": "15d756db-6bea-4e38-9cfe-170b964f5403", "comment": "Malware payload (Dridex)", "value": "564fd85a85a873024ddde792c6b766e1d39282509f0feea3f65f04921be2b334", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618925885, "uuid": "b2dab84a-f127-4f01-be97-1cc0e7b69c09", "comment": "Malware payload (Dridex)", "value": "bf4a24b731e3c205ba40f9922adaccb24b715379", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618925885, "uuid": "f19ef7b4-a3dc-4d5f-8b84-f90849293382", "comment": "Malware payload (Dridex)", "value": "66024944642da3ba801ff8f92fbfbcf1346a8c1ea5354ca335c4907b53986a6a15cf9b1db39a8759ac0a5a51020913cd", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618925885, "uuid": "271b87a8-e56b-43ec-b192-fe52c2f58693", "value": "6FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618925885, "uuid": "084ad8e3-75ce-42a3-b3f6-c1d21e7902ff", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618925885, "uuid": "9e4c32e3-0fc5-4ce4-a3d7-d0f633280902", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618925885, "uuid": "27b94910-8012-4029-bc09-1d326b5d2740", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618925885, "uuid": "b12a63a8-fd9f-4869-bd8a-1ef1b0b6fe72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618925885, "uuid": "cc6b42f6-2aa1-449a-96be-2ca913dad8d8", "value": "564fd85a85a873024ddde792c6b766e1d39282509f0feea3f65f04921be2b334", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67772c53-a1d0-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618920202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920202, "uuid": "33b42d10-acfb-4742-bf21-727457176e46", "comment": "Malware payload (SnakeKeylogger)", "value": "764abd8daf6dddba262e3bbae25fdbf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920202, "uuid": "ec422aa9-e68e-4582-ad9b-32774011cd91", "comment": "Malware payload (SnakeKeylogger)", "value": "56556e830447f0c2c6093cf975f23d275ad7fa9b88d468550a23ccd24b431a45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920202, "uuid": "8edafcb5-513a-4272-81c7-ee906be84172", "comment": "Malware payload (SnakeKeylogger)", "value": "50e8ce314166970d06120941a85f1ecb4d29a53d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920202, "uuid": "a36c0bcd-69db-4eae-9186-2c26419a6b94", "comment": "Malware payload (SnakeKeylogger)", "value": "b9d233a4be4b037ed7ceed89c8111f0dc68df04a813d18334b1eecdb547047a1e61118da55eea7dd06558480ec818374", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920202, "uuid": "b7d5098b-f086-49c0-bf27-5128a8f8d4a4", "value": "EE2412405264D23ACE13CBBADDB1656017751C4FE862D22AE48CBF1FB47A9BCF921931", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920202, "uuid": "535e8abc-96b1-47db-aa5a-f9fc5acd9fdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920202, "uuid": "677e73ff-590a-40c9-a06c-1ab1a2a790df", "value": "3072:tAPD5soyttSkJVmGr6+Nwb8yCHCpEr7ZDlKGcQ+4Sjmj7QQ5KprRsFzpL8Wb3NZL:ePtXOY/+Cpu+QP4mjFsiFWWxrlQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618920202, "uuid": "613aa787-3415-4233-8ce0-bd8208e65859", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618920202, "uuid": "e75453d7-2f0d-4236-af90-a228de21ef0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920202, "uuid": "03ef7007-5f2b-45b8-baed-b1a72b1369f2", "value": "764abd8daf6dddba262e3bbae25fdbf5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86907f58-a20d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618946454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946454, "uuid": "4463be0e-60b7-4107-92e4-cb1e52c33605", "comment": "Malware payload (Dridex)", "value": "0b908f667ad13664defdbfc187a6cd3a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946454, "uuid": "b6d15e35-be17-4f2d-83c8-265f7e27e503", "comment": "Malware payload (Dridex)", "value": "5668328f6af3990c843f18b9a1781a3be0071d423aedd342bf26c8a093e83e42", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946454, "uuid": "93ca5d41-d0d9-47df-af10-8c82cb44674b", "comment": "Malware payload (Dridex)", "value": "3392a40bc7b8b293619fbad48d294c5fb516cb4d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946454, "uuid": "9d9e1175-23dd-46f2-9772-e3c0cab5ac05", "comment": "Malware payload (Dridex)", "value": "e02e49abeedd3f9dcc7cc117647d717c8f640d6a823c30248fc5032a9634dc9aa2d5bd80c0ec56f37b1673146d48e98f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946454, "uuid": "2711b601-6e12-4178-9d07-238a562aa276", "value": "C4F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946454, "uuid": "2e8cba17-2237-48f6-bb88-4eeebe3121bb", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946454, "uuid": "dbe5ff4c-82da-452d-98ef-ca791eace3a6", "value": "3072:0wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:0wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618946454, "uuid": "cf852b8e-bf90-49ab-b21a-cb319150e9ea", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618946454, "uuid": "d0edb2cc-46a5-4d33-b8ed-361a790a81a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946454, "uuid": "1a6ae5a4-13d4-4af0-9778-1edf564fdc42", "value": "5668328f6af3990c843f18b9a1781a3be0071d423aedd342bf26c8a093e83e42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173f385c-a22b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618959152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959152, "uuid": "c40b77ab-225c-4bf1-8e86-2acf26ecf0de", "comment": "Malware payload", "value": "715bd23d518811ec970b9288cfb597c8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959152, "uuid": "0adfef6c-2cfd-4692-ba52-4d7b6fcf18e0", "comment": "Malware payload", "value": "56fe9a0f74d14a3992855acd45b0f73f663abecc4066d39838218402a0555f73", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959152, "uuid": "cf2f07c3-1abd-4d03-94d7-3493363f5916", "comment": "Malware payload", "value": "ac72a4d1740020e2398a8c15e6d701b42a822767", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959152, "uuid": "9fe5aebc-8769-4c08-828b-288cfa1fb051", "comment": "Malware payload", "value": "364d00461dfd8d109cb629ae19da908447f21ac5e4d284d07a8f4e5222ea38aa06f250117623628cbba71125a8177359", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959152, "uuid": "2b96913f-eb03-488b-95d5-f11bb888592b", "value": "BAD2E76B50A47115E9A34A702966ED313B2CA7708C80D14EF47A515CCF82BBB74ECDEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959152, "uuid": "22a962ee-9980-4959-ab0b-228c9d338778", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959152, "uuid": "6fb08717-8f89-43e8-a442-5daffc88abff", "value": "384:sxH+LVD1BzlwkrUgIg2p1xd9GISjbKHdsqXtJjPH0zG99KnarnTsE+H2Ghh:SsprOzr9GISvCHH5+ah+fhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618959152, "uuid": "b7a35030-953b-4565-be2b-24e848b6b101", "value": 31048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618959152, "uuid": "1b64e2a7-f79f-4ffe-8825-45fd66b0cde8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959152, "uuid": "507dddc0-2ed0-49e2-ae7e-c43388a19cbd", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.19445.26450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e93fbe4-a213-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948910, "uuid": "c6491f0a-8e53-4615-baee-e7adc0da106b", "comment": "Malware payload (Dridex)", "value": "0021da37aa6a78b9e91c3f07f80e83fd", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948910, "uuid": "ef3fa7ff-88fb-42bf-8948-94bd83e26545", "comment": "Malware payload (Dridex)", "value": "57195c3a8eac4282e6f9c1c1ece7ec8e7a3c2842cbc07f03f0d0eedd12dde722", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948910, "uuid": "1cb3d85d-b9da-4424-8439-6666601a092a", "comment": "Malware payload (Dridex)", "value": "c13b892ff8af727e9c54ca49037158cb1bad0fa2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948910, "uuid": "a2020fd0-8240-4c14-a62e-b619ec092629", "comment": "Malware payload (Dridex)", "value": "b31a985252aaa201498d7b10055173e68c4ec085603fa089ce4a27b65c8dec31cb996eae0d07bb6f9741c9f3892d23c3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948910, "uuid": "762d0618-9287-475e-a66f-684712f35ce5", "value": "BAF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948910, "uuid": "8f6d0c27-f5bc-472e-a4de-18d630223211", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948910, "uuid": "db8eb45a-9f8a-4cea-9b64-63f50c9a49c4", "value": "3072:tA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:t3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948910, "uuid": "6deb3a28-c21f-4982-9fde-1ad7969bdd29", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948910, "uuid": "63ea08fe-bb97-4017-9b62-fa586ecef297", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948910, "uuid": "16d81280-178b-4e5f-837e-ab488789363c", "value": "57195c3a8eac4282e6f9c1c1ece7ec8e7a3c2842cbc07f03f0d0eedd12dde722", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7595d26e-a217-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618950720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950720, "uuid": "11f28e0c-9107-44d4-b954-ca7364a4c08a", "comment": "Malware payload (Dridex)", "value": "8728ff272c6bb5f41467e5f95a751708", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950720, "uuid": "0a9a616a-b398-4eb2-ad75-6575490305f9", "comment": "Malware payload (Dridex)", "value": "57327a266eaed68aeb3b8c53dedeaaf59698dc807b9809b3eaa7d6cf7890a369", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950720, "uuid": "e0ce7587-1116-446f-968e-5e436dbf8085", "comment": "Malware payload (Dridex)", "value": "ebb8757e47d631432ab630396c8fa789a24742a3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950720, "uuid": "4f6e4387-7991-42ab-9fc4-a3310c5561a9", "comment": "Malware payload (Dridex)", "value": "31e80cbd78dd88c327f6e4a9c503140ee73aad2712d068ac12968ceb6188239dc9e36e0067d4044e6611e6dd523b00b8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950720, "uuid": "1546074e-e751-4b78-b5ff-3c14f4a0fecd", "value": "5BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950720, "uuid": "50d4ad07-86ec-4bfd-8ed7-5385b83045c4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950720, "uuid": "1a902dbb-4c59-47b1-9de4-4c12561d962c", "value": "3072:mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618950720, "uuid": "ab14cff4-cb74-4d3c-b782-6615635c06ed", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618950720, "uuid": "8106c65d-2e5a-4e6f-9897-4c9ce53c8b38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950720, "uuid": "e6936f49-864f-48ee-a5d9-a44c6c244a26", "value": "57327a266eaed68aeb3b8c53dedeaaf59698dc807b9809b3eaa7d6cf7890a369", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8e340f-a222-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618955589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955589, "uuid": "74b84ae2-2d78-4ee0-a661-6cc2734fd091", "comment": "Malware payload (Dridex)", "value": "2409ca50e200b4c207b3c4dc5ccb2838", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955589, "uuid": "2d879f6f-6088-45e1-a066-b9b90c284f48", "comment": "Malware payload (Dridex)", "value": "575283e1126fc04b4c603138687efd60e6e2eb93877557f7f5c0d294bca61727", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955589, "uuid": "29be5905-1762-4724-8c46-acf6cf6da31b", "comment": "Malware payload (Dridex)", "value": "643078da2fe451f2a4ef45a59f70d57c718ee57b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955589, "uuid": "a968e699-1356-4b38-a33e-bfa656cef8f7", "comment": "Malware payload (Dridex)", "value": "7075f2c300d524befe819d986b0498aa3640430c962164f89c63c5896dfdbe54b5b1f058e053d6e99eba08f426cecc72", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955589, "uuid": "f74a614b-0f1b-47a5-9898-2a3e71b2e6ea", "value": "ECF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955589, "uuid": "aed0ccfc-202f-4947-ae78-a24fcd0d4154", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955589, "uuid": "80054bb1-3343-4f05-8e12-a318c5f1b4dd", "value": "3072:dwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:dwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618955589, "uuid": "d6ea1083-f608-4209-9335-b7e0dbc58598", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618955589, "uuid": "68500b3a-d4ae-49fb-9fb7-6532d594b503", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955589, "uuid": "e89250bb-239e-45ad-938b-8cae7d44c323", "value": "575283e1126fc04b4c603138687efd60e6e2eb93877557f7f5c0d294bca61727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d4b23e-a19a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618897191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897191, "uuid": "15753645-631c-4136-bfae-e7cf8f86f558", "comment": "Malware payload", "value": "85894dab57947ca3d40417e90c38233c", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897191, "uuid": "4052ed63-b4a9-47c3-a310-60701cb2ce75", "comment": "Malware payload", "value": "578c01870c99923807b8207bdbfa93a31ee6891807a441756f56290a750dbe3d", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897191, "uuid": "414d3a47-e974-427e-9c71-340b19fc9fee", "comment": "Malware payload", "value": "91eb924305eaaddfcec146b4acce2f2fad43e9bd", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897191, "uuid": "f0e0ed86-ad66-4631-9693-159c0b634da3", "comment": "Malware payload", "value": "510b1d5ce7e45d4cc0ccb1846a39d6060b3563cf07497279e67ecbcb2e99ada6ddff87f88d639a1a5c472bb6b23feb9a", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897191, "uuid": "fc54681e-a481-4e33-8f78-4af3f1e3bda9", "value": "ED54234086A04D6EE31B4474F5749089F798B4FAE8803DC4D48417D49EB7BAAF69F6CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897191, "uuid": "0d32527d-cece-4c96-835e-70b5bc8259ca", "value": "6144:nOaEudcNIWzTfQAQudRsZEQ2gYxswF3TmazdFvyVbe2HG3QKRFoTNE:nOm+FzjQKRTgJw9NvKbeOGAKRFoa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618897191, "uuid": "2c9fdb22-f498-4792-a104-deab4c4385bf", "value": 304981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618897191, "uuid": "3a554b08-8bde-45de-9845-f5e8caf67513", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897191, "uuid": "06cbd0c2-74a3-4816-9c42-0784f189dd33", "value": "Invoice #473.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48178833-a205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618942913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942913, "uuid": "c8e5c158-9b01-4f56-8e1c-cba5ad3c3e8d", "comment": "Malware payload (Dridex)", "value": "4c567c377c4a71a3e2aa23a4169dbf79", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942913, "uuid": "4244acd8-a187-4753-b4f0-51250283ca1c", "comment": "Malware payload (Dridex)", "value": "57976ac13f9fcc13ba30a96f902808299989daa37b7f3c1dc61e97d476580ee7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942913, "uuid": "22fefa8d-4f54-4481-9f2c-e4e118bf4b63", "comment": "Malware payload (Dridex)", "value": "89f87fca58196577b3ef24628faf3b7aa9bb05fd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942913, "uuid": "cb4bd8cc-ad34-4446-bb14-c7a69f8330fb", "comment": "Malware payload (Dridex)", "value": "d7d582a32393272b8b218af979a6f74e7030294574aca56d23383e4202083ef587b834dcff54f3478f4e4128cf0ed47f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942913, "uuid": "0c445825-6f40-41aa-84ee-842b71f69dbe", "value": "73F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942913, "uuid": "933790f0-e995-493b-8408-8d9649706cd5", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942913, "uuid": "5e07bbab-2bb4-4c40-b34e-106256300609", "value": "3072:JwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:JwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618942913, "uuid": "fbc56045-951b-4d6c-a2b0-d685be45d058", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618942913, "uuid": "0dc26419-81a9-43f7-b7e7-0ebc1bcb751f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942913, "uuid": "d7b9c531-e9a3-4571-a1fe-a0737d54f0b5", "value": "57976ac13f9fcc13ba30a96f902808299989daa37b7f3c1dc61e97d476580ee7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731441ac-a212-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948568, "uuid": "52069cd6-8b68-4b3d-9fe8-107b19ba5082", "comment": "Malware payload (Dridex)", "value": "9103d0a0e748195ebb93556bfc456569", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948568, "uuid": "0f8a1f49-2c2b-46ec-935c-a835401960a0", "comment": "Malware payload (Dridex)", "value": "57b091f42bcea53307f67f83627a5a2fa5d519dfdafb194b4ac98c840048a09e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948568, "uuid": "a64695ea-d74b-48b8-a771-f996259c2daa", "comment": "Malware payload (Dridex)", "value": "8568bba95330583886c137f084e3fb12d97fdf7e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948568, "uuid": "1d29970f-b08e-46b6-954c-14d2b7e533e0", "comment": "Malware payload (Dridex)", "value": "235b0f169f944e3786bf37697df2417f016c19a913173dc65556a3534b57bea584b14d1c2404a9c2d23882badf1853f0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948568, "uuid": "5a8d8996-1068-4530-aeeb-14baeefa2a2b", "value": "F2F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948568, "uuid": "1fba43f5-dab6-49b3-8c1b-631029561021", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948568, "uuid": "5492371b-4a69-4ba9-9d44-60eeba4f8367", "value": "3072:KwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:KwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948568, "uuid": "18e1cef4-68bb-46fc-92f5-493687f40ff8", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948568, "uuid": "6e76971c-7fe6-4e83-b669-690f32e3a59f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948568, "uuid": "e3085333-a9e4-40a7-8305-a5146dcb97e5", "value": "57b091f42bcea53307f67f83627a5a2fa5d519dfdafb194b4ac98c840048a09e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "332ad434-a1ce-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1618919255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919255, "uuid": "b174480d-26fb-4577-94f8-bc219891a6a9", "comment": "Malware payload (Gozi)", "value": "dc5e328072d873e1478de921fa17355e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919255, "uuid": "ad10f190-955f-46a6-b321-5a54fcb57c07", "comment": "Malware payload (Gozi)", "value": "57baa46a0ebab9064fc9fc4e48fa0bbbe7241b9014c84a66e5f740f630066279", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919255, "uuid": "2146c804-4b98-42ca-9014-07876b9fd60b", "comment": "Malware payload (Gozi)", "value": "3cef43ed558cd0572b3a7c36de04d096d64fdbaa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919255, "uuid": "52f0c64c-b94d-4377-a3da-2930171359e7", "comment": "Malware payload (Gozi)", "value": "39374ed13581cd6f446312a3bb11d7e2f23e24e54b671445f1f1b3e44f7b4e61018e9930d6f3f1b5cbfb645220f74110", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919255, "uuid": "e23b6de8-4617-4b60-b1c0-dd80f4fdc104", "value": "5F15AE127682C472D1721A308D79D6F509AEBD254F3089DFB3D82B3F6B765C24A31B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919255, "uuid": "3be0fc03-2a7d-4f0c-aa16-582aa5ddf0fa", "value": "44651f329c07f336663299858381870f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919255, "uuid": "6f5aba12-d0af-4a56-a49f-1ff366616481", "value": "24576:DxoXEeW0BLDnAyQ8jbVINuAzNm4etJkeyeYV:DJ4pcAVINusNm4+kefYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618919255, "uuid": "bcc3b282-4059-4e52-8e68-667ac3e6e2b8", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618919255, "uuid": "a113ce5a-17a9-4615-931e-1be030cda075", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919255, "uuid": "74b8c125-fd93-4b1a-b802-0efce125dc89", "value": "dc5e328072d873e1478de921fa17355e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0a2581-a1af-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618906115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618906115, "uuid": "e42723d6-118e-405d-9d49-eae97e65a8aa", "comment": "Malware payload (Dridex)", "value": "f42cb458e3eafe5bcfa700d4c6b78b3a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618906115, "uuid": "7d0a7f99-3f26-4aa6-988e-c7e8be597eb3", "comment": "Malware payload (Dridex)", "value": "57c3889aa243ed54a09394bf7efe13ce2fca1e5d71a59e1af98f5856269850bd", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618906115, "uuid": "f223ef64-da10-4875-b843-8a6efe462eb7", "comment": "Malware payload (Dridex)", "value": "db7955b0268b407e51cbe511af6f550410130332", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618906115, "uuid": "dee9119e-32c8-4fa6-9b31-d954f90d73eb", "comment": "Malware payload (Dridex)", "value": "6f1b254e50a23d746c88932f27b19c46f227fefecdbb95b898339501a42bb8a58d84b44b0aab034f681107845727c43d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618906115, "uuid": "f1c3e094-ee1b-42fa-92b7-5f83b3b14400", "value": "FCF3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618906115, "uuid": "20cd0923-8d7b-4ec4-b926-55abd18f220c", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618906115, "uuid": "ae567c6f-b22d-4373-a067-187211919418", "value": "3072:hwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:hwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618906115, "uuid": "c2807ec8-78e6-4971-84de-28733e948db0", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618906115, "uuid": "f7c04799-6479-451b-85af-9824b9b56b6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618906115, "uuid": "4ab5bd5d-06d8-4bda-9532-7d6df2ceb976", "value": "57c3889aa243ed54a09394bf7efe13ce2fca1e5d71a59e1af98f5856269850bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f773ad-a1f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618937546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618937546, "uuid": "f09ee6c4-90b8-4471-89c3-6cb875b1b590", "comment": "Malware payload (Dridex)", "value": "01c5099fb726c9336c6362db8250ae65", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618937546, "uuid": "164e6bf3-39a2-44c0-a297-289ffa501791", "comment": "Malware payload (Dridex)", "value": "57cfc104cf0a1d581e81398a4527e915478c53a230cfd680dd03aa2607708d96", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618937546, "uuid": "7f8ec30c-6bd7-4e3d-87ae-92c6d6ec63a3", "comment": "Malware payload (Dridex)", "value": "2bd7c34f236e0c671ef31be66067aced97d21e5d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618937546, "uuid": "96d80c40-efc6-452d-a9ac-fd1faf17de86", "comment": "Malware payload (Dridex)", "value": "a7c503561587c67a99cfed36eb46136b5d39ecddd50aeae4b4de03180494a2b3f078b69ea409ff25d0fa5aded30d6ffe", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618937546, "uuid": "6f89618b-fd52-4b90-9e1e-c45438e2e46b", "value": "78F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618937546, "uuid": "5e474358-5808-4184-9f0a-19b1804e8038", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618937546, "uuid": "ce83597f-781e-4247-8fa2-3ca1bd1bc356", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618937546, "uuid": "7e4f9f44-f070-4591-8b2f-d4c9424451cd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618937546, "uuid": "23f800ce-3bc1-4727-9d07-404ce6a0c5a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618937546, "uuid": "925f81ab-edbc-40e8-a6fd-4507f9723a68", "value": "57cfc104cf0a1d581e81398a4527e915478c53a230cfd680dd03aa2607708d96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d406a6b2-a22c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618959898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959898, "uuid": "cb33a54d-b3f5-4613-9237-c7d2a0b9469c", "comment": "Malware payload", "value": "1df95193a6739791b42b4a49231cead9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959898, "uuid": "747bb7ea-284a-4ac5-88df-d382502149a3", "comment": "Malware payload", "value": "57d032a3612e70e661892e4f3f06d605adde737508b152a28d3a7bfcf223d502", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959898, "uuid": "326a73e1-c057-4545-b242-87c65a32d7e3", "comment": "Malware payload", "value": "b883a39c02aabf3f24c0495af8b5f74df6f49c04", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959898, "uuid": "780cd8bb-4bb6-452a-ae48-ef7c39a604a4", "comment": "Malware payload", "value": "df7c7e704b3b1a80e2083d753e51982fac850aa972487146ec07e0b6779704cd05a0c1b4df2608db30ea60c2cef31062", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959898, "uuid": "b78be920-10d4-4432-a108-9f8fbae8c169", "value": "76F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959898, "uuid": "0f2f2a14-c74d-4d62-8e72-89a91d102f26", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959898, "uuid": "c98a0d05-d8c6-4f87-a931-cfeac250e654", "value": "3072:kwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:kwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618959898, "uuid": "696d3b29-b53e-4a07-9167-8f8bfc4f214b", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618959898, "uuid": "39f5a114-5046-4222-98be-ad4d8457302d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959898, "uuid": "7867895c-e277-4dcc-9f69-bfc4ddc110ac", "value": "57d032a3612e70e661892e4f3f06d605adde737508b152a28d3a7bfcf223d502", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f8bedf-a233-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618962851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962851, "uuid": "5e1c0c1e-e9a1-4634-9242-70bc8e837629", "comment": "Malware payload", "value": "d424e8c52d36ce552d9b8e06f4f8c798", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962851, "uuid": "da09d1c4-5a11-47d1-b19c-d03f1f324c11", "comment": "Malware payload", "value": "58056d8fcef697ccc6f61b84d1b31ca3d71cd9f1e38c5bee9510b2849cafb956", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962851, "uuid": "7ef0f593-c2a9-4b8e-a0d6-9ea59c3cf8ee", "comment": "Malware payload", "value": "88f9fcc7570dfe3adc31ad96d5b750f183daf637", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962851, "uuid": "df3effe6-ced5-4698-b0ed-6b0c5bef3a35", "comment": "Malware payload", "value": "d4528d5ebb16926193d1cdd60200378d28a1328827a2222d63822423beee87e4aebe0b8c9e2bdab3626cbdaf598df2de", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962851, "uuid": "d4ba3e56-923c-4f18-ab73-c018bccaed7a", "value": "04F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962851, "uuid": "5aeb1f99-741f-42e3-b818-bfc3bba31573", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962851, "uuid": "a658f64a-6140-4f1d-93cf-f394b075caf9", "value": "3072:YwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:YwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618962851, "uuid": "40463382-1fe6-4a2a-9b53-7cae13b93151", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618962851, "uuid": "77f3c841-e158-4ada-99ef-69f1c2eee50c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962851, "uuid": "5e160088-7ce4-472e-8417-5d514ce2612f", "value": "58056d8fcef697ccc6f61b84d1b31ca3d71cd9f1e38c5bee9510b2849cafb956", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3976fee-a181-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618886453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618886453, "uuid": "ad4dd7a7-97a3-4837-bd75-b93d265ecac9", "comment": "Malware payload (Dridex)", "value": "0bee200e1d1eb96e99c740d20084dd2f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618886453, "uuid": "941f0641-e74d-45e9-846e-2ddff89ed948", "comment": "Malware payload (Dridex)", "value": "5813ae2b585b50028eb23b17936632b2ac5474f7581ebd142f6c957fc041bc0d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618886453, "uuid": "c4f41134-9758-4bdd-bd39-fe27c0011e32", "comment": "Malware payload (Dridex)", "value": "63d9d160aaf3a4bd04907845a3d46086d703e782", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618886453, "uuid": "6638bd85-945d-48ba-b508-5229f146f1de", "comment": "Malware payload (Dridex)", "value": "02fe810386932252c5766e89f3e2320aac822d977d92604f39c58a788b2e8bd76a7e247224c0306e5f7901114bfe5f11", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618886453, "uuid": "f70464ad-557f-461c-8489-d2eb632086b2", "value": "F4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618886453, "uuid": "9dea9277-b309-4f15-bd01-863dd27ef260", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618886453, "uuid": "db7f4b13-200f-459b-8978-315b1be02fb9", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618886453, "uuid": "ed8fa6a0-7ba6-4dfa-a9e5-ecb393003685", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618886453, "uuid": "1a1c96fc-6c8f-4b57-8efd-545d2a43ae03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618886453, "uuid": "cf6c98a9-6882-47d0-a487-8faa176039db", "value": "5813ae2b585b50028eb23b17936632b2ac5474f7581ebd142f6c957fc041bc0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6affd5-a232-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618962246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962246, "uuid": "6bd3df17-7198-4406-9654-6036ff99786a", "comment": "Malware payload", "value": "ec7cce28fcc5fcc45bdca17980f40138", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962246, "uuid": "62314c7e-1da3-47af-9c00-59d1d4a17387", "comment": "Malware payload", "value": "5813c36766d2f15fa0acc228aa6235d31038b45ee86818a288184229e46c1d37", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962246, "uuid": "e8cc01b9-17d3-4661-8085-c2ab50312be3", "comment": "Malware payload", "value": "b0b9d552506c2c85e0523c78f068b134600642b5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962246, "uuid": "e62d852f-088c-4ce3-bc86-e925633ba077", "comment": "Malware payload", "value": "e899333e2116218c2111cf26a3e1eff24c051f16f8cdf85f68eab3efece65bba09acf44a5b97d23cee7cfed372fee43c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962246, "uuid": "77390b1a-a643-4951-b1e1-5bcd929e07d2", "value": "94F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962246, "uuid": "53961819-c128-44a2-b54a-689d4c22cec5", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962246, "uuid": "d6ef6a31-18bc-48d0-bac5-95f8df716e15", "value": "3072:UwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:UwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618962246, "uuid": "db4de59a-0021-469d-a931-281f2a78137f", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618962246, "uuid": "5e02dd23-fd8b-4d2b-baa9-f3afe63d841a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962246, "uuid": "9c0e5d35-9cbb-489f-9f50-ddcc3b87ef16", "value": "5813c36766d2f15fa0acc228aa6235d31038b45ee86818a288184229e46c1d37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3837a6-a1ad-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618905013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618905013, "uuid": "9d7ac67b-fa08-41ce-9a6d-31ead0b6dea4", "comment": "Malware payload (Dridex)", "value": "4a4f1cbe9951017709d3e32764889006", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618905013, "uuid": "16380535-e889-406b-af91-6f6b82d52a7d", "comment": "Malware payload (Dridex)", "value": "5848a40bea1f6c09b3f2102d4ef80b700fbda6d8af938cd7650048fa5cefeb71", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618905013, "uuid": "ca9246a4-91fe-44b4-a001-63c8b62cfd67", "comment": "Malware payload (Dridex)", "value": "ac3cea3cb86667589e7a34d834572b17fdcb0876", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618905013, "uuid": "98e97b4c-8ccc-43d6-b6e4-e91d53e8a539", "comment": "Malware payload (Dridex)", "value": "fb6111d6d15ab5c34d559e0c002305e26c893a04e726c83ea32f3c0287021847b213be12819e3957502d7e1f045ed8c5", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618905013, "uuid": "ebe003d8-1a23-40fb-9515-5e845de21715", "value": "5EF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618905013, "uuid": "fd1a1f22-b69e-434d-bbec-871a5f0f69fc", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618905013, "uuid": "5fa5a040-3a58-4e1c-aed8-3a2a05cca640", "value": "3072:DWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:D42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618905013, "uuid": "3da105c5-30de-483c-bb2e-308d6789d903", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618905013, "uuid": "a7ddc47b-cde8-4139-8666-6526f685b818", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618905013, "uuid": "9424656c-d59a-4c0e-9151-661bf0837910", "value": "5848a40bea1f6c09b3f2102d4ef80b700fbda6d8af938cd7650048fa5cefeb71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9673613e-a216-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1618950346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950346, "uuid": "5d2aaf91-0d75-478c-a371-1a24e27755bb", "comment": "Malware payload (GuLoader)", "value": "a5927ee08778a03b9a85bdbe8614045c", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950346, "uuid": "c64a3a77-9e6d-4b48-9bf1-d62b7fcfb616", "comment": "Malware payload (GuLoader)", "value": "5848b5efeea58c2c353b352f7f0d2043dc806cb9d387ca6206562773c95cb37e", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950346, "uuid": "ebd0a2e8-1032-4d6d-84ba-408fda9bc0bf", "comment": "Malware payload (GuLoader)", "value": "b11323997a972820db34d5353f89327de427c2a7", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950346, "uuid": "165984cc-7bc6-40c9-8e6f-ceea16059528", "comment": "Malware payload (GuLoader)", "value": "01845e543f71c9a665eca55e9d02e8a9d7fb27f2d1e4c764bc329807ac1037b1d0b4ed7b09edea7a660d61c484d18806", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950346, "uuid": "91bbed26-b7b3-4a2e-a7e2-36d8ae5d742c", "value": "BED3F8EE3300F467D91944F05A111A7AE497F830449EDA0BD3CF221A25B8AFDBA25F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950346, "uuid": "fe148b27-9cb8-462a-b458-9459fa7dcd2d", "value": "0659423d60820a035f3fbccb287c8f5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950346, "uuid": "843d63ad-91db-4a75-8b7c-ea6e29c6d6c7", "value": "3072:CjwSXir4m3L2Zo/NKf/G/PmS0EJ179sI6pVefWaaQq:CUSXCV3yZo/Qf+/PmS0EJp9sXpsfWaaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618950346, "uuid": "c4a62000-30f4-479e-bd4f-e9ad615a98f9", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618950346, "uuid": "5915a062-c096-4d6b-b26b-0e90da353a9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950346, "uuid": "51d53137-6e89-4212-9ad6-a112c6fc9b0a", "value": "New#PO-910974.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9aafda0-a21f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618954270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954270, "uuid": "ee4316f4-ab71-4e43-9a7d-425b39ec1342", "comment": "Malware payload (Dridex)", "value": "fb3eda93c4012290e06a1644e9244cfd", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954270, "uuid": "c561972d-dcb6-45b4-8f4a-163ea60172fd", "comment": "Malware payload (Dridex)", "value": "58a8da9d2f985dd7a1501e7fcf31bfdf531a8faab46fc7f6f556139e38819900", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954270, "uuid": "04a7c9a7-c115-4a51-9191-f2b1783f5bb4", "comment": "Malware payload (Dridex)", "value": "655ea133f22038c74d46ee164862bd7bf89057b6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954270, "uuid": "019b416f-d368-4b70-a535-423557a49dd8", "comment": "Malware payload (Dridex)", "value": "ba45974f2c957a1f625493127eca749cd7a44cdaac494a9c2bfd25994926aeaaa39392403e71a993855cf0a0ebaa474f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954270, "uuid": "92b31bb7-0df3-44e7-8484-9a7b9aead86a", "value": "2CF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954270, "uuid": "64ad1ab7-444f-42e8-a3cd-8f1b215d087e", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954270, "uuid": "d6c028c8-da8b-48c2-b126-e6a8de1920ba", "value": "3072:KwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:KwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618954270, "uuid": "eac56b8b-e903-473c-ba89-ec96eab0c5f7", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618954270, "uuid": "e7808c9e-2833-452d-a875-b2269d2c20ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954270, "uuid": "542b0489-0ef7-45e6-8876-ead2d7bb74b6", "value": "58a8da9d2f985dd7a1501e7fcf31bfdf531a8faab46fc7f6f556139e38819900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c6facba-a222-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618955402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955402, "uuid": "5bab04da-253b-4ce7-99fb-427f346cece0", "comment": "Malware payload (Dridex)", "value": "c44385dc7e42af08429904f4782de2ad", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955402, "uuid": "b7c3d92d-99c0-4998-ba5c-e45df51cec89", "comment": "Malware payload (Dridex)", "value": "58ae62e95a6e99937b942aba2fa2363f19788190e268e3ec9ad11c4fe3ddbab5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955402, "uuid": "577e9ed9-fc46-4a14-923f-a875ce372490", "comment": "Malware payload (Dridex)", "value": "9a5daea8b2ea01da7accceab9bea2320cf1bd3f9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955402, "uuid": "0be592cd-7d5d-4dcd-b3aa-8b5d53727774", "comment": "Malware payload (Dridex)", "value": "512a845013ffbf404dd4fcf801736d518f5d09ef79642d2153538a4d20fbe4839f3ed0202c2fe0861b1a1ae4bd6f0413", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955402, "uuid": "c90e57ca-27d0-434a-a008-2effa2eb358f", "value": "73F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955402, "uuid": "0b5d3b03-e658-4a07-b4de-170874bbff90", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955402, "uuid": "1a4f7d0a-78a7-4e4a-ab62-0b44687fa593", "value": "3072:QwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:QwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618955402, "uuid": "b2729cda-8ea5-4403-b102-d898390a125c", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618955402, "uuid": "7fd73258-788c-4452-81a5-3e0a828cb2a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955402, "uuid": "f017fa61-dfda-4992-a165-157fa2196adc", "value": "58ae62e95a6e99937b942aba2fa2363f19788190e268e3ec9ad11c4fe3ddbab5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e14c4e5-a1ad-11eb-abe1-42010a9c0039", "comment": "Malware payload (CobaltStrike)", "timestamp": 1618905073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618905073, "uuid": "7f3dbaba-0bd6-4e8e-8834-11b8d1709370", "comment": "Malware payload (CobaltStrike)", "value": "bfe860c06b77a5a1525654be5187d336", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618905073, "uuid": "c0560c81-630d-436c-94ff-9b9c5e337377", "comment": "Malware payload (CobaltStrike)", "value": "58c874f4e6d5747159c6bde9037fbe4769279a308e04271a527e0e3a07a964c2", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618905073, "uuid": "aa2676d7-5f6c-4b7e-bc01-2490634ce3bc", "comment": "Malware payload (CobaltStrike)", "value": "42589ac6da1a3377282112cef4b9a2686c6e4f44", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618905073, "uuid": "6fe0d903-ff16-4c10-b9bc-7da265dd759c", "comment": "Malware payload (CobaltStrike)", "value": "39841f9efc5529520dc369c21b2e079f13c1eaa744cf655b0bca5f68845fd091d18f334720501f17dbdd353fb1d9e30a", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618905073, "uuid": "c05c0f7e-55b1-4b5d-9d72-abdb18be663c", "value": "CA94F1977A5830FAF422913885625619EF377C76322C6B9F1694B2122F377919C3EF20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618905073, "uuid": "2ef12c64-5daf-4d61-81bb-af8e0a00c708", "value": "2978511173aa387175a876036d5ec230", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618905073, "uuid": "39d1b899-83d9-4f2a-ad81-c8a57dc60451", "value": "6144:txH1Ek1uUMGD9zt9PYfG8hH1dshHD2kDbF8AAERuzxey4xpGL1/iozAu:nik1uTGDpPbY1dshh98DEkzSgdiwAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618905073, "uuid": "6402b687-91a5-456a-a19c-4b02cdd255c1", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618905073, "uuid": "e93be540-bbc0-4e6d-b0b6-8e687075548c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618905073, "uuid": "faef51c6-ccef-4d75-b937-f4dd1b05b415", "value": "SecuriteInfo.com.Variant.Ulise.161906.28000.22675", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3839e247-a20c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618945893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945893, "uuid": "dadae135-6973-422a-bd1c-e3f628b2230c", "comment": "Malware payload (Dridex)", "value": "e5114ab832e9a3a6b99a5ca293b6f54d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945893, "uuid": "f3608747-4ab5-43bd-b5be-e6ee15078d72", "comment": "Malware payload (Dridex)", "value": "58d436acbf12a9c9ed1a9326d90c407c688c8d9b511f025f1d14b4ed579902e4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945893, "uuid": "ccbbd326-ad53-4c79-8a37-79ddac425cac", "comment": "Malware payload (Dridex)", "value": "169ca50d2242265bfd39757f0239f8cbe9d43a38", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945893, "uuid": "81be1814-eb26-4138-b07b-bd9875da5527", "comment": "Malware payload (Dridex)", "value": "51270a793be6bb6ee66e61b282a58ebc73bc950fe69d79f750a64d9c897c515176db20a4ad366713dbb5457b76ea7aa0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945893, "uuid": "1a0d41b8-954b-4c19-8b53-e66d7012dec3", "value": "0CF3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945893, "uuid": "c167e3f9-3a5f-4b7d-988b-62012a7c19ec", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945893, "uuid": "92eb0fb0-d136-4927-853d-e4c81f963f1c", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618945893, "uuid": "fcc3dda3-dbeb-4694-a796-9e2990e81d75", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618945893, "uuid": "61e2bed9-bb8f-43f8-940a-75401d63f829", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945893, "uuid": "16fc204f-8dbe-4f0b-8429-1c3c736b60e9", "value": "58d436acbf12a9c9ed1a9326d90c407c688c8d9b511f025f1d14b4ed579902e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d21ec39-a213-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618948854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948854, "uuid": "4f7cb492-7c06-4861-b40c-ab6419ffc65f", "comment": "Malware payload", "value": "3a8e22a65673cd0a2a7f5157c2c465bb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948854, "uuid": "0025a614-f535-476d-8d12-8242f2738757", "comment": "Malware payload", "value": "58f7b1dd28c24592a5cd71b47ac954378fe00b2c629c37361a27b7cfa04448e6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948854, "uuid": "03ef7b8a-81ba-469c-b4c5-b4a7187322fd", "comment": "Malware payload", "value": "ebce4991512249f3a1fcd5146243228632ae538f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948854, "uuid": "62e58f5d-152e-4312-bb10-b7579efe67e6", "comment": "Malware payload", "value": "456a30d0cc842c15da54de5fea50b95df5cd9ba08a3826e589199721546280daf7996a029992d77115972d885acb4352", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948854, "uuid": "6342c045-d769-41cb-8459-6861f63f6639", "value": "0C72CF6021D11230E720223A3621A37D9839ADD2CAF57968786C21E86EEF3F5951FD22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948854, "uuid": "ff519959-e597-4f56-af46-5e01c8f37929", "value": "384:RkhfkdNLqLtEquswKqgM0qOH1/NaIZpfuTIswo7jc:KANLiTq9OH1VtZcw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948854, "uuid": "dbf35e8a-573e-4619-a702-b2ef86471af7", "value": 16241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948854, "uuid": "955d28af-89d3-439f-855e-67d5d09bfa0b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948854, "uuid": "817b406d-4a8d-4072-92ef-db98e38bd49e", "value": "e-Fax_Message_329800021831.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a64b795-a1f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618935078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618935078, "uuid": "e4ec7aaa-2f3c-4495-bcfb-2d3bd4a09299", "comment": "Malware payload (Dridex)", "value": "840950afc49cf3c4de891ff69a890a02", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618935078, "uuid": "9f049c74-9b22-435b-b040-5fbe6db4d241", "comment": "Malware payload (Dridex)", "value": "59147b49c456d1233b5cf53e82c3d6a65051db37f23068aafbd5dc63c8b56bbc", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618935078, "uuid": "31d7257d-3c5d-4105-bda7-ded0204ff6cf", "comment": "Malware payload (Dridex)", "value": "8bab8bdc6c366d8c3b691ddd97cb42a5b9934fac", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618935078, "uuid": "ca35013b-a0a9-4688-be26-5574931e37ec", "comment": "Malware payload (Dridex)", "value": "9734ce30571b53af304a93d125a751b64162d4f7aed7ab8870703ee7b7e2d9ff3f9eed887799baf5ddb17af57adcc438", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618935078, "uuid": "82f27b18-a387-46fd-9737-d4616b8d69c5", "value": "EBF3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618935078, "uuid": "9d3cbd9d-296c-4f6b-9be0-d9c1010f0005", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618935078, "uuid": "b1c83593-03a9-4309-a573-6a8dd80db1f6", "value": "3072:owZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:owZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618935078, "uuid": "7a5d6848-9606-4b4a-b1ac-fdca65752c75", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618935078, "uuid": "c0507c23-135e-44a4-b080-056f78c3d4bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618935078, "uuid": "6d41f14e-ad9b-4b1b-a784-d8e25fe1b172", "value": "59147b49c456d1233b5cf53e82c3d6a65051db37f23068aafbd5dc63c8b56bbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee49e0a-a1c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618914148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618914148, "uuid": "87c6b7e8-d995-4928-a518-2462b08ec6b2", "comment": "Malware payload (SnakeKeylogger)", "value": "6eb32cac0e85d03169777af587df7711", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618914148, "uuid": "debfbef5-0ce8-4dc6-857b-c2143f2911b1", "comment": "Malware payload (SnakeKeylogger)", "value": "59396d086d40357f1228487c040b643dd0349259ba13556c198648a9d51ccf1c", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618914148, "uuid": "ef50399c-274e-48ce-ae36-01ed7ecc95d3", "comment": "Malware payload (SnakeKeylogger)", "value": "fb038c098bcb3dae5d22e3d07924797fdfd5f6b7", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618914148, "uuid": "10397ebc-7126-41e7-b26a-f425da171f2e", "comment": "Malware payload (SnakeKeylogger)", "value": "c3d4970b7d0f0f51ba59a8963d17131ab2e164c6870735cfbd01a1252989c8e2435c5288ba8a5d668e02f59b389dd413", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618914148, "uuid": "b11f2143-dfa9-4f8d-90f8-dd1e48fbd50c", "value": "3AC4F12133A8C754E87F8BB91431514023F7B61BAB25EB1D7DAC116D4E6B64287227E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618914148, "uuid": "8140e7be-842a-46b6-9110-6d38d5f9953c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618914148, "uuid": "97f28247-00bb-4f87-8464-6d3f1657f568", "value": "12288:m/zRRRRRSAI1dfgLdggFBfKvN+MJdU/maemFF5PHblsDIk8Qyt:2RRRRRSAI8dxPoNNXU/mAFPxWInt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618914148, "uuid": "0fe9986d-13e5-4549-9c14-620aa2c370cc", "value": 586240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618914148, "uuid": "43422567-5a3c-4d20-8059-b151a1305277", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618914148, "uuid": "0afc4ae1-0968-497f-b092-e869a74a7498", "value": "Account Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9080f21e-a20a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618945182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945182, "uuid": "daedb4de-ef47-4547-a656-4ad25b858176", "comment": "Malware payload (Dridex)", "value": "b013cfd524469ea41500c0f2bf68636d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945182, "uuid": "8f78f634-6211-4e01-9a39-ceac6c0d007e", "comment": "Malware payload (Dridex)", "value": "5989bbc6bfa4b85ea8180e199ccd08ac04d25f050d7ac9d26915dfd01b0a5894", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945182, "uuid": "14ede2f9-7402-4ad1-8f8c-4409c4e72a48", "comment": "Malware payload (Dridex)", "value": "cb51e23c239d2abc0a8ab2d36f68df2efeb17ad0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945182, "uuid": "56f789c4-3035-42e1-8d89-7e57643a7f6f", "comment": "Malware payload (Dridex)", "value": "368522166d8e0d220d185935610496b1b738fb402e7a36b1ff1025cb1485851100960a26c9862ff499eb42375fced439", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945182, "uuid": "454a8886-e6c5-4a6f-ba92-1bdbd703576e", "value": "2BF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945182, "uuid": "cff8ea22-3894-4bf4-9bde-1e1033d8a348", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945182, "uuid": "44d4098c-1373-4c20-953c-6e3416db2daa", "value": "3072:TA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:T3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618945182, "uuid": "eb671626-e9c0-4c6a-bd31-697168a555fb", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618945182, "uuid": "be99a1a2-1612-4efd-b1f3-567509bb53bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945182, "uuid": "2d435014-1ead-434e-8f10-e8906aa0fa4d", "value": "5989bbc6bfa4b85ea8180e199ccd08ac04d25f050d7ac9d26915dfd01b0a5894", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03494ca3-a1b6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618908867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618908867, "uuid": "df036f59-10c0-494b-a4aa-cb3b3727bb77", "comment": "Malware payload (Dridex)", "value": "bd2d2d863b87631b47caa37e86e09997", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618908867, "uuid": "da90fea4-9e27-4e6c-bea3-63eb92b4c0ea", "comment": "Malware payload (Dridex)", "value": "5995764c85bc4332e4e916f0b6cadb15a88f44286fdb1143c21751c32da2d809", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618908867, "uuid": "0c426967-18ad-4c59-87fa-5e29602034d5", "comment": "Malware payload (Dridex)", "value": "e2ab59a3876605b8a2176f4d2c162de971dbba8e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618908867, "uuid": "615c6e9d-28de-4ee6-bd5b-0594eec034d5", "comment": "Malware payload (Dridex)", "value": "d3490d02e97fee7e3ddd0d9ef31bbf86de6771ee0e37e6ba371279f94ac8d69c62f3aa2ee5db3d4d30b177dda23f1c7e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618908867, "uuid": "1e732403-8aa7-4740-bffb-586df0bd3615", "value": "D8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618908867, "uuid": "bbb3b76b-82e7-48b4-a478-82ab1a8a6a38", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618908867, "uuid": "c6fdc767-0992-4dbe-bf00-8bb2f80aa4d1", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618908867, "uuid": "5c1f886d-6650-4ac8-bfb6-b86d6148cc84", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618908867, "uuid": "fc6c0ced-0a59-4b0e-8f3f-c171ba64054b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618908867, "uuid": "770fb6a3-5c15-4baa-b63e-99e89c16de39", "value": "5995764c85bc4332e4e916f0b6cadb15a88f44286fdb1143c21751c32da2d809", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d0f51a-a200-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618940897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940897, "uuid": "66326c4a-e3a4-40f5-a614-a80c1ddb5bc1", "comment": "Malware payload (Dridex)", "value": "e76c7614bc6670518bb61b41dbea581f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940897, "uuid": "4d08d43e-7926-47d5-9eeb-40533b971f67", "comment": "Malware payload (Dridex)", "value": "59c265b342ea6f8f6f8e6c3824638a2a3b1d7d7a497fdce5f4120ac5b7eff432", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940897, "uuid": "f15d9bac-e3d1-4c23-980e-435ab7eee5ab", "comment": "Malware payload (Dridex)", "value": "01d78a4ad0a6f706bfa0373b02786793b0252991", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940897, "uuid": "2d270ae7-f968-4556-b84a-55a0d22caa9f", "comment": "Malware payload (Dridex)", "value": "1bacc5dd3135ece5c03114df6a61bc3436189a57548ace05682f3ad3b72fa3133acd92a0d09abde4a73beef92bee630b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940897, "uuid": "71019dd3-b6a4-4596-aec9-3cc660170189", "value": "7BF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940897, "uuid": "2de0414e-30a7-44c2-87c0-df38636902b8", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940897, "uuid": "c9226898-649c-4706-aa33-fa313a8b0d04", "value": "3072:SwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:SwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618940897, "uuid": "9c745f91-74cc-4f5c-aae5-4bdff5dcec7a", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618940897, "uuid": "1f64a5b5-678d-4263-bf55-de4dd6147e59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940897, "uuid": "80cabf7d-c15b-4edb-8958-a7eb916132db", "value": "59c265b342ea6f8f6f8e6c3824638a2a3b1d7d7a497fdce5f4120ac5b7eff432", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "820c3489-a229-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618958472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958472, "uuid": "6695b800-3492-4fc8-9af2-828c591e0042", "comment": "Malware payload", "value": "caae3af9ad7b7cd843dbe802e2b25677", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958472, "uuid": "3a58f76c-3d21-4d2d-b118-130c7bab90cc", "comment": "Malware payload", "value": "59cbbe9168855d95d200cdf3e6af3b4e417b23a704f3a34dbc2219c776ba321c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958472, "uuid": "d6d21717-ea02-4925-903d-a671827af44f", "comment": "Malware payload", "value": "ff1327ff0e722aac1ebff452a82e1fa86a3e4418", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958472, "uuid": "ad9bdbef-e799-49ac-a8f3-878e010be801", "comment": "Malware payload", "value": "86268c1918d4176f37e020272af8514b11c353f5f91fcb351bb5e426777f7ce775950f8b6f2cc8a8c59176fe3ef6711d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958472, "uuid": "d3844453-568d-4b58-8066-e5e358bdc407", "value": "06F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958472, "uuid": "0c0ffb6c-f74f-4e1c-b27a-f9a4cb30a236", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958472, "uuid": "e88ce299-16c1-4815-abf1-ced6927303e0", "value": "3072:OwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:OwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618958472, "uuid": "f79f3212-3274-4d4c-a009-9afe25984bbb", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618958472, "uuid": "ec2da9d7-b855-4d2b-b80c-d68eeed034a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958472, "uuid": "9b15f770-47c2-4c44-9646-e64676249942", "value": "59cbbe9168855d95d200cdf3e6af3b4e417b23a704f3a34dbc2219c776ba321c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ef0194-a1ac-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618904712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618904712, "uuid": "b1a74e52-c9f9-4a6e-8f0c-6ec99e1f5ea7", "comment": "Malware payload (Loki)", "value": "fcbd2024b2b2635da9291bca054c42fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618904712, "uuid": "4471d9ac-3142-48aa-ab7a-f97be39eff1f", "comment": "Malware payload (Loki)", "value": "59e6627133bc5e0cc86e36c36127a40706ac0625972e1d801c2e41174804dae5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618904712, "uuid": "41c3e6a5-d270-4a0d-b9cf-5d46682318de", "comment": "Malware payload (Loki)", "value": "3b79859ad092c90039c03a09190a183c3e98fb87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618904712, "uuid": "176e5462-1c81-49f1-9291-7f25b1ab1e52", "comment": "Malware payload (Loki)", "value": "7b03f1fa46941cfa77448ca460a949cf9e26d4f8b639bd45d50b8e961fb66c06476224431ce131a80b6a705a4d8b2d7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618904712, "uuid": "d3e6b7c9-c278-4980-8fc3-69d11e8c1a39", "value": "F935E79D366075DFC967C9328A685C64EA507C7A431BD20BE02335EDEA2D89BCF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618904712, "uuid": "b4a63d6d-ba43-45c5-9b48-74da776d3fd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618904712, "uuid": "1e69d449-7aa3-482e-bbef-51a9b634a708", "value": "24576:CCjoSmPD7OJfZBNaBRRRRRp6pFu7Ylt+ccFuop0ResOC+n6JYeuJ+:JNYRRRRRp6cY3rcFuopGe5Cqeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618904712, "uuid": "a0651cab-2eff-4faa-8575-6d19d71df1a0", "value": 1142784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618904712, "uuid": "3d3c3c3e-2a00-45ff-a321-45936293f0d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618904712, "uuid": "0f8895dd-0d1b-4317-9a5b-9f952c37e1af", "value": "QUOTATION-FORM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f8862a-a229-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618958289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958289, "uuid": "74e3b34f-b2dd-49be-80fb-bf154a60dae9", "comment": "Malware payload", "value": "4f1a4b5d1c99107ae19dc7fe76a16000", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958289, "uuid": "070806b8-9a1b-495a-b1f2-44d96721dd21", "comment": "Malware payload", "value": "59ed01f5830eef7c406d81956c6322ee78233b8a7938ad5c445193fb83cf7feb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958289, "uuid": "0e89f4f6-9a2e-4839-9f1e-724ce07a67a4", "comment": "Malware payload", "value": "1f038cc00f2f12bad68fb25d1ce71a5299bdd58c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958289, "uuid": "386697eb-34d1-45ca-b2de-3bece850b4ab", "comment": "Malware payload", "value": "96bdaa9c5d5e92cbc9e1a66defdb9fad90e62fd080320c7fd53cc5b837c80229f92d169f077d147bec659ad3374185c3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958289, "uuid": "bbb824f4-fe9e-4a7b-b012-aff29397c35e", "value": "AFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958289, "uuid": "789c938d-bb00-4274-8a5e-8e272f1680b5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958289, "uuid": "3a103a03-73b7-493b-a8ca-578542a7b1aa", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618958289, "uuid": "e125af49-f2e3-4b0c-af82-f304e25e514a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618958289, "uuid": "08a103f6-1680-412b-a83c-41f963752144", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958289, "uuid": "2c0dd9fc-6323-4cda-b88d-d820fe5e7b70", "value": "59ed01f5830eef7c406d81956c6322ee78233b8a7938ad5c445193fb83cf7feb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fc3347-a225-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618956739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956739, "uuid": "bbd90c17-ccf3-4a6e-890b-c7d611f64bda", "comment": "Malware payload (Dridex)", "value": "97ad8dda251239da2ececf2ad8ec6e29", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956739, "uuid": "de55a4c9-4e81-465f-af59-534f00b41f40", "comment": "Malware payload (Dridex)", "value": "59efd10bb73e60082435aefe5922caf125069b459518ec06bbb9a8dbf67ae975", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956739, "uuid": "57281d73-66ce-4cee-8248-d6a7f2e37e13", "comment": "Malware payload (Dridex)", "value": "8966a8a21b509090ffd03023504903ef2a32c477", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956739, "uuid": "111e003a-4739-44e0-a34b-e864510de75d", "comment": "Malware payload (Dridex)", "value": "88b5a7e90883c2e79dc952886e12fd553afa74c21df1ad789b5f2bcc301a90ed77d8cb23ae2f76b65bf6a06a36f599d3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956739, "uuid": "ba1bf1e4-be44-4725-8b29-9e6dee9fb821", "value": "2FF3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956739, "uuid": "7c7bde8e-5150-4989-b4f0-6101e01bd246", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956739, "uuid": "06517566-c5e1-4318-ba44-075504fda8b7", "value": "3072:xwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:xwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618956739, "uuid": "011d0a50-606f-49c3-bc2f-67aa1e1f0b5d", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618956739, "uuid": "373a3637-257b-4d32-8ed1-e77c23a0b1b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956739, "uuid": "769ae6e0-8e46-4cad-9ca9-7e2fb1af259c", "value": "59efd10bb73e60082435aefe5922caf125069b459518ec06bbb9a8dbf67ae975", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84bbb9ba-a1cc-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618918533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918533, "uuid": "93d55209-d63e-4fac-9b12-ca255dc6ed33", "comment": "Malware payload (AgentTesla)", "value": "0152c29a0311f35d715518908c2efe8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918533, "uuid": "3629d1ec-a53b-44af-8928-cc28b268beb8", "comment": "Malware payload (AgentTesla)", "value": "5a182bbc0b6a621737548194ea2d6bb8f2d41c30ecb7c0252a30c14508a40c90", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918533, "uuid": "fbb664fd-3d40-46df-abc7-225308edfac4", "comment": "Malware payload (AgentTesla)", "value": "e167834be76dcbbe7e8e3eb15ccc688376a79715", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618918533, "uuid": "e94d7275-4139-4fd5-ac0b-f62aa26ad75a", "comment": "Malware payload (AgentTesla)", "value": "578a4316acdda880ed5d68523d13f84cb1c5a9ce306bdbcadddc769da6d6a333a30db9b3600f7b8be612c5b6dba3898d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918533, "uuid": "7e9725d6-34bb-4ba9-8907-7ea81c34188e", "value": "02D4012133AC9758D87F5BB41860910113FBB71BFB15EB1E7DA8119D4EAF2828722793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918533, "uuid": "9e8e4381-cc58-4987-a99c-715fdc5edc59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918533, "uuid": "4a5dcab1-a58e-49e7-a0e2-59a85f5a1421", "value": "12288:x16lsrqYM7SWki71VT2WhbJxxqsOTv+t66AfDMhwRQyHczRRRRRn:jKhYM7SWkibTJhbJyjv+c3DbQyHIRRRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618918533, "uuid": "91138f06-c74b-41a9-8a4f-60572a9db3d4", "value": 633856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618918533, "uuid": "6de754ee-eef2-412e-8ff4-8210011d8926", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618918533, "uuid": "66f6b094-35ad-4469-a1f3-7dae6ff9a49c", "value": "PO, Order#4500484210.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d11444d-a1c8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618916749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916749, "uuid": "f20d015d-5256-4573-a227-42ba7b31faca", "comment": "Malware payload", "value": "f0d2e8772edec3cd06c466c7e0663fea", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916749, "uuid": "453e4fe5-b14a-454d-866d-a1035d5bf412", "comment": "Malware payload", "value": "5a19dcb5ebfce41a9901ecbaa5449c581ba0362e886b6160ce2c443066f63278", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916749, "uuid": "337eb552-945b-4af2-915a-3815cffc338b", "comment": "Malware payload", "value": "a9fc4c27e8ab44352ba2cf32a3036519336b5de0", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916749, "uuid": "e57f612d-f2f7-417e-8cec-54a26b887ebb", "comment": "Malware payload", "value": "e32e565c09536eaf34a173381899f2118ceff4f45c6a57fea7a6aba3a1bb9683c4cabf2ec0b5dbc69376d6c3e6cde882", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916749, "uuid": "89c0f317-973c-43e5-9544-c550a4c16412", "value": "A6C533CEAE90EA67D81B2DF561CD103BD4AFFE05788088A53F28731878735A063D691D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916749, "uuid": "073465c8-3b90-4296-b1ed-308279bb1b03", "value": "49152:ZE55Auupm/q+/Nk7DKMEtBMp8AHhRG6fGd8I4iSE+3htgfNHq:q555uoJNsDVp8ABwIGdGiS/gfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618916749, "uuid": "a25f16bc-ea1b-4b43-a2e4-fe089f306fd4", "value": 2679808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618916749, "uuid": "27e94aeb-2d0c-4255-ba3d-1f74ac32b60e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916749, "uuid": "63f2ac0d-27ef-4e8a-b962-770608f10178", "value": "PRC-20-518 ORIGINAL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2819da8c-a21a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618951879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951879, "uuid": "d0840437-1925-4a08-afce-d4391efa87d3", "comment": "Malware payload (Dridex)", "value": "edb64ac44784c02b0be0d614ceab1302", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951879, "uuid": "1d0057b9-5d30-4d32-b24f-5e425b7d1d8e", "comment": "Malware payload (Dridex)", "value": "5a48cfebf088b5cb11eef49f5c9cf35bd40e7fa7893b17f3b201f9bac767a992", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951879, "uuid": "431d0054-8f83-4783-97c0-a546832415ac", "comment": "Malware payload (Dridex)", "value": "3e232f89856c1251d0310b20bab8ae40c2a154ee", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951879, "uuid": "c4c60cf9-ff29-4969-b78b-3b534179c533", "comment": "Malware payload (Dridex)", "value": "9130589aae92abc0a87cf0e2249309f37ad0394c312baf45ca4294f7b9fe5c976806f4197d8fd36c0e5f4f398e333cd1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951879, "uuid": "13a95ee9-7574-4efd-8200-7c722de80540", "value": "C7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951879, "uuid": "6adb3af6-18e2-4dbb-9411-4e9c276d4044", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951879, "uuid": "5e3f349f-5939-4006-b1ae-465a8fe20b5c", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618951879, "uuid": "2639cabc-03d5-4da2-8c9f-2abc89233134", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618951879, "uuid": "735bc661-e218-41b2-a46c-f198a38de3d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951879, "uuid": "434c2c45-4567-4162-8600-37bd13b1efc1", "value": "5a48cfebf088b5cb11eef49f5c9cf35bd40e7fa7893b17f3b201f9bac767a992", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c02528d-a207-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618943752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943752, "uuid": "5c6fe024-97cd-4fee-b534-963eabf7aeca", "comment": "Malware payload (Dridex)", "value": "28a9fb2afd947d7e3a6d2736a5cdbac4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943752, "uuid": "2b4e646a-94dd-403c-957b-04c1d01a421c", "comment": "Malware payload (Dridex)", "value": "5ab91f09fb4dedfebb1a6875f50e91578c52da162c42edfc152e50b241e2a943", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943752, "uuid": "10330c83-6aa4-4bb3-afd7-e720d29cf513", "comment": "Malware payload (Dridex)", "value": "ee5c1d3ba35c1018aaf0addbf4b344f9b68919e7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943752, "uuid": "9a95f3a9-9b46-4137-871e-583ef5a1f4d6", "comment": "Malware payload (Dridex)", "value": "54790928f8345f1e32aa7aae618d3ccc524116168a970ed6abb235b2db2ac0a8c5ad2cedb355324ffec8b0c6ba1f42cc", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943752, "uuid": "2f1ffc38-5f15-43fe-8be5-d0a214c1bc67", "value": "F4F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943752, "uuid": "051c3526-9623-41c3-b096-e94c689b30b1", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943752, "uuid": "64884499-fc29-4f79-a033-6218f6dd919e", "value": "3072:ZwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:ZwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618943752, "uuid": "cb70aa6e-d72b-4d8c-b5ea-89cdac619373", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618943752, "uuid": "3226fee0-670a-42f8-a147-fdea28fb097f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943752, "uuid": "2c82e85b-0929-404b-b474-9fc6c5cf3eb5", "value": "5ab91f09fb4dedfebb1a6875f50e91578c52da162c42edfc152e50b241e2a943", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24b8ed4-a21d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618953399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953399, "uuid": "48b5cf20-3bef-4345-81b4-5ee10df95c5d", "comment": "Malware payload (Dridex)", "value": "c193ed91fb30140f839f8fda6db58fc4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953399, "uuid": "38cb090e-200a-40c1-9c8c-510e1b6eba22", "comment": "Malware payload (Dridex)", "value": "5af7cd45415910ea744e99c9a2ba35574b66a0391979ae62c6fa7638098eba31", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953399, "uuid": "95be11e3-3729-4e85-a40b-3352cbabaeb7", "comment": "Malware payload (Dridex)", "value": "408f4a375a0087aeba884f5ce59ce730d88ceeb9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618953399, "uuid": "8ac00c03-825d-441e-ba9b-1d48b182964c", "comment": "Malware payload (Dridex)", "value": "30b1ca593999ec3cad32949990c119c51007c5d5869e6fc12331511ecb334a982b311da7926b73964afb1759265c08d8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953399, "uuid": "06a4cc55-10af-4916-aed1-b63b8fc844a4", "value": "7DF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953399, "uuid": "b798ebb1-047c-4687-b6f2-5a982d0a518e", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953399, "uuid": "af8fdab7-ae6d-4133-b6f0-2c699c35165a", "value": "3072:rwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:rwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618953399, "uuid": "62204048-1929-40b5-a9a9-260eea88ff72", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618953399, "uuid": "d48f2186-b46e-4b45-92aa-4c6cc9f2545c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618953399, "uuid": "b35e0cc7-9110-483b-9356-82753c6fcdd4", "value": "5af7cd45415910ea744e99c9a2ba35574b66a0391979ae62c6fa7638098eba31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce44a103-a215-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618950010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950010, "uuid": "3214c089-3d72-44e6-abef-5c74f9c836b7", "comment": "Malware payload", "value": "c57d332e6beca67344b2529fc7821c7d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950010, "uuid": "39c57c7d-3f14-41eb-8e3a-3294dd7fbf2f", "comment": "Malware payload", "value": "5b1ef60b0031b9d39795b609197f66e18ee6485db7962045b2a1ee9954af2687", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950010, "uuid": "c781699d-940c-4576-a409-773850fd9b43", "comment": "Malware payload", "value": "22870cc8d2648341cdd95bb890f27637e1bf724e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950010, "uuid": "7e04d5cf-7b02-4b57-90b4-9458925bbc7b", "comment": "Malware payload", "value": "6ffd1addc1ec46cf20ca2825aecdfbe79e2dafdcb11130480aeab19d358dcca6b29418695b525a91eba0af4cf467b66d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950010, "uuid": "dfefc337-473e-4035-97a1-87f0f15b5657", "value": "BDF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950010, "uuid": "50fc4d9c-b8a1-48ba-b0bc-91af10d8f561", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950010, "uuid": "b3da0ee0-ae0d-4420-b999-89a2fc7c3d49", "value": "3072:uwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:uwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618950010, "uuid": "ae6d444c-5e74-4cc4-8c78-375c10078a2d", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618950010, "uuid": "ba6810f2-c4bd-4950-8714-214dbd3392de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950010, "uuid": "f681cab6-36a8-480a-8539-edcd7400bdab", "value": "5b1ef60b0031b9d39795b609197f66e18ee6485db7962045b2a1ee9954af2687", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68e8bf3-a1e2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618928119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618928119, "uuid": "32443802-1695-44fa-afd5-f8cf4475281e", "comment": "Malware payload (Dridex)", "value": "c3dd0c89a50ccb91449764a58227d1d4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618928119, "uuid": "558ddb29-0361-4b27-9b3b-a4aacb3897c9", "comment": "Malware payload (Dridex)", "value": "5b1f6a981bad30e3608733fedcff838d79e6c4345f2727678bd032b96ebe9f33", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618928119, "uuid": "cdc6b6a5-fe89-41b0-9426-c190d794b32d", "comment": "Malware payload (Dridex)", "value": "cc0f3622f3c146a5103f3f41118ea9df79a81fa9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618928119, "uuid": "59ce370d-79d1-4dd0-a823-b2abf4e88244", "comment": "Malware payload (Dridex)", "value": "82cf4d31ff45137e39f822aeef4da731ecb65abecb4babb4c39f2dbda8ffd2b57f2a8e689d9f0e8687e9ba455aa54503", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618928119, "uuid": "13b47ab6-0dca-4062-95c1-730b65ae5f59", "value": "DAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618928119, "uuid": "a03ef4b0-d2d3-418c-8f9d-0128625b61a7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618928119, "uuid": "54d8979d-9717-45f0-a27f-1352062c5a79", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618928119, "uuid": "5a07d1b3-17d7-47a2-9f25-067870a6c807", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618928119, "uuid": "d5dd8b26-a9ec-4ed7-83a2-91689fb8227d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618928119, "uuid": "79d4d717-ced6-4ff6-a840-f78edbad568f", "value": "5b1f6a981bad30e3608733fedcff838d79e6c4345f2727678bd032b96ebe9f33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc416f59-a18e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618892024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618892024, "uuid": "3ebe4558-33f0-441c-ad23-4651ffbc2254", "comment": "Malware payload (Dridex)", "value": "4cb20dda0e58a66e774aee224c73f5e6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618892024, "uuid": "43f8aa4a-0e0e-471b-8cbc-e34a91679759", "comment": "Malware payload (Dridex)", "value": "5b32cce7ed70e83a136cc9c4d93697de74c7c50a8159e279fe933b0b2170c902", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618892024, "uuid": "152cdb87-29f6-4b44-b9f3-788ae738b6d0", "comment": "Malware payload (Dridex)", "value": "8ce9289d44c3ca3919a672e9bb78cc8f58a4fec3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618892024, "uuid": "b8637a0c-6011-4168-a75c-050c7dab854b", "comment": "Malware payload (Dridex)", "value": "beee7b60493b0e652db2552d39dc54f06e5f3f9daef8fa8e6873481f3cb19930da0b4b21c376d342e12b69d2dc3bb512", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618892024, "uuid": "f2e0ef56-a836-473d-aad5-416144f9f628", "value": "4FF3D088CBB3E4E6EFB3D37966F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618892024, "uuid": "cfab5258-2b45-46aa-9962-851422e3355b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618892024, "uuid": "a784013a-80ca-4895-98b2-fe32de0372c2", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618892024, "uuid": "9ca6104c-e938-49cd-a0e6-4743a15d6540", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618892024, "uuid": "9de8d7ae-9ebc-4620-8301-0cd765a83d38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618892024, "uuid": "01c10de9-6008-479e-9551-4f8ddfd90979", "value": "5b32cce7ed70e83a136cc9c4d93697de74c7c50a8159e279fe933b0b2170c902", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4cb5077-a22a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618959040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959040, "uuid": "fef46460-0e53-4ac9-8950-920d3a5dbd1b", "comment": "Malware payload", "value": "5c29fca769f759e9be45c9a8c9ee663e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959040, "uuid": "6fa28a7a-a9d8-4576-8734-a565bdc79770", "comment": "Malware payload", "value": "5b3ed166ad8c37aa74a1be495377e13c81fe61aa26bd497aa97552a910b7c089", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959040, "uuid": "ca4017c3-24a5-463e-b62b-a7433bf1fd4a", "comment": "Malware payload", "value": "526f3691f660ba33e02576d290761be0fb10843e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959040, "uuid": "4e207b69-cf01-47e2-8636-af17f88c058e", "comment": "Malware payload", "value": "962f80039716a4095a83a837519ec9e67e6b83966c9238e86ab28b05d4462c3a2b8bdc660d5ce524aa3364b46d5dfff7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959040, "uuid": "f3a2dc14-5754-4252-9b33-711cf037d824", "value": "41F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959040, "uuid": "167f5c58-ec9f-48af-966e-7a90b06abd51", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959040, "uuid": "6c015d25-22aa-4cc3-9204-998b47892ded", "value": "3072:MwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:MwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618959040, "uuid": "adcd932f-c24d-4260-afc3-5a4dc5769f07", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618959040, "uuid": "f2ad7091-0975-43d7-824e-42f019398eac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959040, "uuid": "2ab3d5c8-37dc-4ed9-9133-b25538a7d3ac", "value": "5b3ed166ad8c37aa74a1be495377e13c81fe61aa26bd497aa97552a910b7c089", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e92f4858-a200-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618941036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941036, "uuid": "03caa492-9514-40ae-90b3-548f1eff82f5", "comment": "Malware payload (Dridex)", "value": "f7d9a74772df817b7c9392f46d29dea3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941036, "uuid": "4d2934a2-1b78-4349-babd-1df83d5d62fa", "comment": "Malware payload (Dridex)", "value": "5bb959ff1f6a27f56ae20e74855e266c63aab041117da6621a317bac05dd6832", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941036, "uuid": "eeae0f2d-8da5-46ed-a223-43d0d104a19e", "comment": "Malware payload (Dridex)", "value": "0f9abedf76f9aabedec073b8f8b3e154fb6a46c8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941036, "uuid": "e6489b9e-0220-4271-9cd9-d4b73fbd0ed8", "comment": "Malware payload (Dridex)", "value": "6f5592568624330fd7dd7446cc0139491a9e12cbb6d4f91d2b9a3a2057c99b132b393c5284373e6c2c7fd67e1d1a61e9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941036, "uuid": "d279d6f2-9231-4b1f-9659-647c5bd0bbfc", "value": "01F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941036, "uuid": "f8756d2b-04a4-4642-90b4-05e36ddff6c0", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941036, "uuid": "2f4a8055-8d59-4d04-ab99-7dcb59a42518", "value": "3072:owZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:owZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618941036, "uuid": "00149fc9-a0e3-4a54-b2f2-0d349d0389fe", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618941036, "uuid": "8999c395-7a52-4e01-aec7-e896b6b1889c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941036, "uuid": "b1d3db26-2694-4436-b286-4cfbf2e29120", "value": "5bb959ff1f6a27f56ae20e74855e266c63aab041117da6621a317bac05dd6832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d2bfc3-a19b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618897540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897540, "uuid": "c54d7bb3-ab41-4f91-aed0-240e58967787", "comment": "Malware payload (AgentTesla)", "value": "4cde3609b918d4ef83a1f50dd0e6bc8e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897540, "uuid": "d153c4ef-cb41-45a8-9901-14652da36a0a", "comment": "Malware payload (AgentTesla)", "value": "5c4676ef5bd6f6d10826944d9e51efadb58fbbb936ff5f10d7aa91235c35946d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897540, "uuid": "84ca08de-25f3-4555-b47f-dac7a767b4fa", "comment": "Malware payload (AgentTesla)", "value": "69878bfdfe1b730f802bfa6ad515efdef96aa43f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897540, "uuid": "9973359a-7667-4974-943f-9dae82913d47", "comment": "Malware payload (AgentTesla)", "value": "95445e00c8b7bc2b3d3a1a32285495fde21334d739e2d74f64c204afeaf19657e38f03ff0af21ad15397a6ef1d107142", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897540, "uuid": "04f7707a-bfb5-4296-bb40-5d42d8083d2a", "value": "D305DF3DE34D0E10FB3DA7BB4785E5908279AC261687D62EF8F1397A1832E97061750E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897540, "uuid": "d9e93aef-0c31-49fe-a595-3fd27a51955c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897540, "uuid": "cef6df00-b421-4b91-b7e6-3e963f58ef64", "value": "24576:ySjfRRRRRRzTneKkIgYD+ZP13XN3uhFSexlvwo:yKRRRRRPDdgYD+l139+rSexlv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618897540, "uuid": "949f20a9-8cc2-470e-b370-8c4e41aae5de", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618897540, "uuid": "9689548d-af75-4a05-bc43-1ecb8f725586", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897540, "uuid": "89f21476-00d8-4936-adf2-4e41f6614c11", "value": "PO-no 74GW0942.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94819001-a1c3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618914694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618914694, "uuid": "49ad2694-9299-4e4a-b3d5-975ae66dabc9", "comment": "Malware payload (Dridex)", "value": "1272dbaf54e1b8b59a6c17786b339303", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618914694, "uuid": "8e8d4b22-102a-479b-9843-07fe93d5262e", "comment": "Malware payload (Dridex)", "value": "5c5d363c081841458b588fb7444dfae326bdc228fe5afff4f30c99ad60853435", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618914694, "uuid": "8344433f-5806-47b2-a4c0-4a0e4d136b21", "comment": "Malware payload (Dridex)", "value": "58051bcea02bfd0d655b9347b37407c6935d5f25", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618914694, "uuid": "95c31008-2a92-426b-a4f5-96c74bdfc03d", "comment": "Malware payload (Dridex)", "value": "5fbb8a04aae6d23013aab475d216fc830c70f13aa1dccb1184ffdb1b38febe58771be0dceab9404471ac11a2b4f5a1d4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618914694, "uuid": "435d725f-20af-41ae-9ea4-2de2d84bf993", "value": "90F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618914694, "uuid": "404a4994-b801-4178-960b-1084cf568200", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618914694, "uuid": "4020b9bd-8775-4ad4-9e2b-95f57706ee0e", "value": "3072:VA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:V3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618914694, "uuid": "fad1d42f-2108-4818-bb66-34ce6a45066a", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618914694, "uuid": "15bd48d7-5104-4c7c-9d26-e3e339cd963d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618914694, "uuid": "545e2e8c-e145-4d67-9e12-fd99dfc4b8d5", "value": "5c5d363c081841458b588fb7444dfae326bdc228fe5afff4f30c99ad60853435", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f4ce60-a216-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618950392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950392, "uuid": "8dc10b14-8931-4d94-9219-132cfb25db46", "comment": "Malware payload", "value": "6a4370e664a2740dc596f7bedbdf5a7f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950392, "uuid": "859c4a0d-f732-425f-8327-eb415550336f", "comment": "Malware payload", "value": "5c6978411f24ab3b9af2e5f8f7e2c518e2cef4e8b8f6f6ce2046a4da4291584f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950392, "uuid": "b349d49f-ad5b-4a51-a7d8-7d06cd21816c", "comment": "Malware payload", "value": "26aee5e453a6d7308664e95d93eabda8660cddb6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950392, "uuid": "ae5b033b-6670-40c6-9085-6dc4b4e1e3ec", "comment": "Malware payload", "value": "3d5128011477469c3894b0911ebccd8179624b51b94b99cad3dd1d53c688ac266d6d45a3c07a2abded3e07fa5bedb467", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950392, "uuid": "03e04338-a0ec-4421-aeca-7b14a4e69346", "value": "56F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950392, "uuid": "5e720cd7-be33-46e0-a192-624154c9df25", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950392, "uuid": "579353ca-c00f-4dff-b047-be4f9a1a516f", "value": "3072:3wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:3wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618950392, "uuid": "9156314c-680a-48b3-817a-0e6840d3fc2c", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618950392, "uuid": "f1883b9d-b1ac-4079-9737-32f97077a6c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950392, "uuid": "476e65ab-ab63-47ed-a072-55551cf61246", "value": "5c6978411f24ab3b9af2e5f8f7e2c518e2cef4e8b8f6f6ce2046a4da4291584f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdbc46fa-a192-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618893718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618893718, "uuid": "f6ba755b-fcbc-4e8f-b417-10a2cedb49ed", "comment": "Malware payload (Dridex)", "value": "cd22b44e30497b297409441be2a7bf22", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618893718, "uuid": "4c981f01-a658-441e-bcd5-fa6fcc4969e6", "comment": "Malware payload (Dridex)", "value": "5c746bad59fbe48cd7f36a1824ad1bf86032a34552df64b6cf71e15df82a61fa", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618893718, "uuid": "b13cf9c8-26cf-4e4b-9f98-fb68cdee7cf4", "comment": "Malware payload (Dridex)", "value": "1cfdb10b1167496ac201252ecd2f58c4495b8287", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618893718, "uuid": "4936ea31-bbf8-474f-bd34-ec0c5a64793a", "comment": "Malware payload (Dridex)", "value": "20b868ab038f06acef72195e56b025c7292a8fdcc4219579a021317501ff982c028b5b51bd27f126206640f78adeee9d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618893718, "uuid": "408b540c-8c75-43ad-98f2-5d627cf7a36b", "value": "B1F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618893718, "uuid": "68be3437-3b15-4991-b46e-f352f675ab6f", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618893718, "uuid": "823c19ce-eee5-4a7e-b4df-8c1b52339c9c", "value": "3072:Flpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Flo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618893718, "uuid": "0e0fd380-2160-4c35-a815-156d68dacdbb", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618893718, "uuid": "9fb744fc-b9de-4304-9875-5f8b528d164b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618893718, "uuid": "3730ac9e-6797-4cfa-b276-62b87bfeb96f", "value": "5c746bad59fbe48cd7f36a1824ad1bf86032a34552df64b6cf71e15df82a61fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd9c41d6-a1c6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618916052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916052, "uuid": "2b0766f8-340b-4f48-90cc-c97f4d958256", "comment": "Malware payload (Dridex)", "value": "76382a28a1f04b728afe9c99fcee3c3e", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916052, "uuid": "c37194bd-17db-4db0-8eca-1e6a03504d6b", "comment": "Malware payload (Dridex)", "value": "5c9ef4da2519969dd9e6bec1e3bbcb1f8217312b18600468b1705848634a6e1b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916052, "uuid": "3bf02898-cb1c-401d-989f-20903811c4da", "comment": "Malware payload (Dridex)", "value": "7741e241cb4329a895d7e8f20217d7b82d4fe086", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916052, "uuid": "3ac3db2f-5bc1-4c7e-87e6-1d4159bc3be3", "comment": "Malware payload (Dridex)", "value": "3fc921d1c2d807cdc1c57b5c12236309e2b87a50dfb4fb714da62c1c3bf9fbc97eadb1eaa9766c897691ad2d3f68479b", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916052, "uuid": "7f8e3984-07bd-4e1e-90c6-360530c77df6", "value": "25F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916052, "uuid": "17c8c3c0-3408-4493-99b5-3a6216671450", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916052, "uuid": "d97543a8-572a-450b-88cb-12bfefb5cb76", "value": "3072:kiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:neAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618916052, "uuid": "93e075f3-aa82-4759-8db9-3a4b9914723b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618916052, "uuid": "95f7fb09-92d1-4083-83ad-a67df1ba214b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916052, "uuid": "22f52b43-b932-4bc5-bdc3-9a8ab9a8fc8a", "value": "5c9ef4da2519969dd9e6bec1e3bbcb1f8217312b18600468b1705848634a6e1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848f10a9-a1db-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618924975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924975, "uuid": "813b44db-b911-46b6-a5a7-9afe0fd5cb68", "comment": "Malware payload (AgentTesla)", "value": "cb97de950b0d59dd9bef63ad3465d484", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924975, "uuid": "ce05800b-b23c-4462-963e-6d3730fe4d21", "comment": "Malware payload (AgentTesla)", "value": "5d28e61788bfbafcb9eddda9a73243fb7e898b6ae006729b64ed4faa7734a11c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924975, "uuid": "a634d77c-9c4c-4baf-bc14-eb8c43f91c7f", "comment": "Malware payload (AgentTesla)", "value": "73657899cc6a49e3b32860064a31e1e9bd5bf6f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618924975, "uuid": "ddbdceb7-8030-4dd3-8a11-8bd543fe4816", "comment": "Malware payload (AgentTesla)", "value": "3597e14fa184436308ac80566b0dd17ff2c0ef0fe3ae5b9f534ecbcff471b57c6d18872bf4220a9c6a0e0cf12703beb0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924975, "uuid": "77c6d5f5-5f6d-4952-8c2b-acebd9e70ffc", "value": "226412D8BAD6D357C2CED63C0E0DDD601ABEEF502B58A2112944F349D9B47B19407B3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924975, "uuid": "7ebacdd0-67cf-415b-9a33-4f53320c5ca9", "value": "6144:7hVbLSyeUYxl51KPGy+wfvScjn8R2QZtuemWSo2pagbhnxZ7uY2JN:7hBSy8h1KPN+WvSgn4ceQlBbp76JN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618924975, "uuid": "b2aa6233-c361-4e11-a77b-872ee023b41b", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618924975, "uuid": "8e659aae-1f06-492e-9b24-ca030d2cd422", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618924975, "uuid": "1e7c0fd1-a44e-4e5e-a29a-aa567bccbab2", "value": "PO4589.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b51ff9f3-a1d0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1618920332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920332, "uuid": "ec67e1b4-85e2-467c-8d4e-f98ad0d2a6e7", "comment": "Malware payload (Smoke Loader)", "value": "c78d424eba64076d3af57b29b7602d25", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920332, "uuid": "c22faab1-e2d5-4d4d-8834-b5f5b80f3478", "comment": "Malware payload (Smoke Loader)", "value": "5d82b4f16469d125e3615431b1ccdbbf2decc388e1e3b417d2c0e12e0cca78f6", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920332, "uuid": "1c88590f-764a-4ca1-8cb0-153bccd894ff", "comment": "Malware payload (Smoke Loader)", "value": "c0a75b1e6c61f81f57d810b2cf74599038b51350", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920332, "uuid": "104c8fa8-ea75-4200-ba65-41e06c35db9e", "comment": "Malware payload (Smoke Loader)", "value": "0160d6f3e35c482a0a0a90a5859fe5fe9d4e0b695ae2431ca33197d93dea268957c80e669c57b0935398b05a4ff46df2", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920332, "uuid": "6f63dbdf-f9b6-4d18-88fa-37ef532f65f4", "value": "A2349E1532D0C033D467247295A7CBF65E7B743217A6AA8FBBD80EB91F347D1A62130A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920332, "uuid": "1bfa76e2-7460-44c0-b9b9-738ea6c56bda", "value": "7d1cba165583f87245c44788a2941cf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920332, "uuid": "d0f4e5b3-e59a-4c3f-805f-60754c48f8d3", "value": "3072:YVy08lmgtNct3lW75e3gojOi8EJiIaa2BJ1sShUWhZL5kh2H8Prpoyhnt:CoLtk3s7UJjn8caa2BJhyWqp1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618920332, "uuid": "aee27a86-b337-424c-9a54-4a0fcacd20e8", "value": 247296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618920332, "uuid": "2ffa3ba5-ba81-49a5-8a6b-18bbf5944a04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920332, "uuid": "682d1e3b-ac4a-444d-8b51-8ff76d7ae9db", "value": "c78d424eba64076d3af57b29b7602d25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041016f2-a206-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618943228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943228, "uuid": "6421ad32-259e-4481-b99c-0eb8f691052e", "comment": "Malware payload (Dridex)", "value": "4ee3c5dfd4640536cea975fdb48b4043", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943228, "uuid": "2848c441-0a5d-4423-9591-9ef94d02cb41", "comment": "Malware payload (Dridex)", "value": "5dfa612e12b220cf45e034c0cbd4250860de15f8038bb6c2ff3a4294a284e68f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943228, "uuid": "20ec4926-7498-44a1-a783-748bc7ae4703", "comment": "Malware payload (Dridex)", "value": "339fd5ca47006ac3c630781a1f875abeb4306b36", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943228, "uuid": "aec1ce50-94a0-4c37-b8cd-e2ab9279f19d", "comment": "Malware payload (Dridex)", "value": "3eb3f7c9fc1c93331e18f65da7bebf72c892787ede0a0a7d1d98cbec7b6c2ed26b1e7dc99215668e33aa3664bee7fa9a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943228, "uuid": "5ce9dda3-2283-4ac1-94de-31b28dd61239", "value": "D1F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943228, "uuid": "f7de48d3-77c9-4224-b0b8-823e9d08b60c", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943228, "uuid": "507825ab-e80b-47df-997a-3dd19807ea80", "value": "3072:XwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:XwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618943228, "uuid": "2106f3df-92db-495f-95fb-3eef5130df41", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618943228, "uuid": "19412e82-9929-4666-b39c-c816d9ab3849", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943228, "uuid": "c8cf0cfb-db5b-4b49-92c1-c0074dbd1583", "value": "5dfa612e12b220cf45e034c0cbd4250860de15f8038bb6c2ff3a4294a284e68f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625d6961-a189-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618889699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618889699, "uuid": "2fda6c87-d361-4b6d-8190-267a1b54a4c3", "comment": "Malware payload (Dridex)", "value": "f6ea5058d2c8cbfce0b64489350b70c5", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618889699, "uuid": "0266597a-81f4-483e-97af-219196b9c201", "comment": "Malware payload (Dridex)", "value": "5e0c5132c5582cfbb1964d3177dabf427e76cb956842a7d87320299dd6fe3528", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618889699, "uuid": "7871531b-b93a-4085-a880-56250307eb9c", "comment": "Malware payload (Dridex)", "value": "5c95fd7fdb54276b6b05c8373bba242d4762e294", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618889699, "uuid": "157a6e34-f0d0-4ff1-ad30-6c3e95453622", "comment": "Malware payload (Dridex)", "value": "a5b49cd50ea92eb3a994bada20ba010179218a298b44abdf146106162a3cd3d328d2ac0954f47cf16fa84aa6608a0b70", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618889699, "uuid": "d43fa365-23ac-416a-a765-55700ea9dcd9", "value": "FFF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618889699, "uuid": "a59df424-6388-44a0-b179-4d562b5afa4f", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618889699, "uuid": "0663c6cf-743e-42c7-a0ef-3f3c12661be0", "value": "3072:hiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:yeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618889699, "uuid": "0390b6ab-33e9-4646-a790-b8c7e1c373a4", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618889699, "uuid": "19e0448a-ed9a-4738-9333-c6228fc80e3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618889699, "uuid": "5991bdee-9c6b-4ec0-ac62-771bf757759f", "value": "5e0c5132c5582cfbb1964d3177dabf427e76cb956842a7d87320299dd6fe3528", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3e99df-a205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618942844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942844, "uuid": "6646ff21-cb61-4850-8d59-241c919f8cce", "comment": "Malware payload (Dridex)", "value": "a284a194c37b815ee8c67414c2910710", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942844, "uuid": "7fc12cc9-d9ff-4299-87e5-10ec24018567", "comment": "Malware payload (Dridex)", "value": "5e1248218dda2f31d78b8f74277dbceef01e39d82777f2f5ee5ab474c8ee6139", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942844, "uuid": "a3106345-58dd-483b-9b20-978c09e672b6", "comment": "Malware payload (Dridex)", "value": "1386ac7992bcc2ec2625b77edcd58b9c5adf272a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942844, "uuid": "6374e06b-f088-40dd-8d06-266446a1e906", "comment": "Malware payload (Dridex)", "value": "d27d6bbac93e2e52297961e861ed890fb068072f66f7141f838d029cb38e454daac971ad732a4bfb1f13e803502ace84", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942844, "uuid": "f962575f-7bcc-4459-85bf-892c0f0ced63", "value": "FEF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942844, "uuid": "d48fdae8-2fd8-4de1-9a42-68fc454a32ba", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942844, "uuid": "8ff61b11-f6cd-492c-a419-97f37dc59ed7", "value": "3072:UwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:UwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618942844, "uuid": "eb972e3c-7438-449e-b11a-b3b7c2987471", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618942844, "uuid": "fcf1ce51-cbca-418b-9193-1d7d59844e0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942844, "uuid": "9b7f4194-97c9-4d03-a11d-1b2f276953d4", "value": "5e1248218dda2f31d78b8f74277dbceef01e39d82777f2f5ee5ab474c8ee6139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ef7e9c-a20e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618947040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947040, "uuid": "ecd9c5e3-3153-43ea-8e10-a408733b8ec7", "comment": "Malware payload (Dridex)", "value": "662d5a4353ae37ec4f54682e0beff6ce", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947040, "uuid": "384a8e9a-9881-43e9-b9f3-202eff5f4a10", "comment": "Malware payload (Dridex)", "value": "5e1582d745c860227b02bfa331702a56dea370cc35e615aaf2cc3121f103c145", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947040, "uuid": "2a49ae3e-332a-44e5-83d4-83f2fa49ac8e", "comment": "Malware payload (Dridex)", "value": "ffa0d3489ccd626331613f46cf730802c0d8d5c6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947040, "uuid": "14b2fa82-e7a0-4506-98d8-e5310d3d107c", "comment": "Malware payload (Dridex)", "value": "3e4c86b33b42b55835a5417c89825c059548d8017dc76018570eba58d503d79822417ca5b15895b62ce46121fcac0752", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947040, "uuid": "97eb6a50-5dbf-45cd-97d3-06b9887f2e7b", "value": "D8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947040, "uuid": "5dfeea48-8adb-4a3f-bca2-971e62e53bc5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947040, "uuid": "a46876bd-8cd6-41b3-9492-0871d4dedc88", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618947040, "uuid": "d9394d83-1262-4d35-ad04-e5e440e638b8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618947040, "uuid": "ba5655b7-d782-4c76-ac14-3bf8d2120e78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947040, "uuid": "f2520092-ad57-4984-a764-af6c993e70d5", "value": "5e1582d745c860227b02bfa331702a56dea370cc35e615aaf2cc3121f103c145", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7464d528-a20c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618945994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945994, "uuid": "ba58e934-8cb9-4648-8f45-2cf4709c4415", "comment": "Malware payload (Dridex)", "value": "bf608afcf9d65c17e7b221240304ddce", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945994, "uuid": "af08c080-3939-46e8-b430-e8251e06b66d", "comment": "Malware payload (Dridex)", "value": "5e67d00b6f0738a89618ddadb0348cb567d0af48a7c11ea1ae2a366a2a05aa61", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945994, "uuid": "ab614a54-6b3c-4aba-a1a3-93b020701f16", "comment": "Malware payload (Dridex)", "value": "aaace93dd3da69ced7cbdbb9e04dd6943470cd6e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945994, "uuid": "a2bb8d16-4b67-486d-b48a-514581f39856", "comment": "Malware payload (Dridex)", "value": "fd2a68c7382c17c0afb9f80fe21a243b88d3ea56933f1e9ec15c21ce14e4bd61aa3d804ea337e14d2ff3adc779f9b50c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945994, "uuid": "e5f61239-8c3a-4378-8d1f-be44d4c0424a", "value": "FEF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945994, "uuid": "a61aee4a-7a4b-49be-9a11-b8ea2fb72bb0", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945994, "uuid": "b6f6cfe4-2fda-42e5-bad3-7008f24d70a8", "value": "3072:OwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:OwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618945994, "uuid": "d019e72f-03db-4ef5-9b43-236ea182811d", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618945994, "uuid": "cfba0dd5-de95-4f80-bf5d-c84f696634ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945994, "uuid": "f873489c-0f48-48e8-b02f-db3ce7eb1078", "value": "5e67d00b6f0738a89618ddadb0348cb567d0af48a7c11ea1ae2a366a2a05aa61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e05eb2-a176-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618881515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618881515, "uuid": "c226a314-6435-4fa2-a541-fabcc191ca37", "comment": "Malware payload (Dridex)", "value": "718e8bec02d85375a7e987f3d42e0d7e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618881515, "uuid": "4c3d0c3a-4604-45ce-a9b9-7df4d8104804", "comment": "Malware payload (Dridex)", "value": "5e6b4da9506e17de3d13bd6b8edf5bbf9dd91d0d52f08c74015eac994fbcb8af", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618881515, "uuid": "8d995465-4fe4-4a7e-8465-62919d891e10", "comment": "Malware payload (Dridex)", "value": "6fb1fa4449819875483772c2f122f9da79f28bc7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618881515, "uuid": "87a327b6-457e-4040-85dc-79ab30b3454c", "comment": "Malware payload (Dridex)", "value": "782ee6984b832fe1da212b6bbfb0db4e02c03e547c27c4ef027bc432e5d0b65b7da0ba9528a8aa94a60bc159ce7f5253", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618881515, "uuid": "81315765-32e3-4e2e-8cdb-ba7dcb122294", "value": "60F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618881515, "uuid": "5c616afb-a2e5-40d7-8d00-bca41835b710", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618881515, "uuid": "3554f4b8-047b-41b4-9828-d499e9a26edb", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618881515, "uuid": "791b6e34-8d96-4f03-b069-6cab18a60b6a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618881515, "uuid": "72ebc6d7-1ca1-4d02-b6eb-7bd7e5907345", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618881515, "uuid": "5c9cf888-675b-44dd-af48-c48c9544f314", "value": "5e6b4da9506e17de3d13bd6b8edf5bbf9dd91d0d52f08c74015eac994fbcb8af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891f6bfd-a204-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618942592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942592, "uuid": "1bb9d059-ad27-4cd1-8182-d4384c51dd5a", "comment": "Malware payload (Dridex)", "value": "df7332005148cc2af5c68fb1d05876f9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942592, "uuid": "547d2a02-a255-4bda-9659-44ccd9122cdc", "comment": "Malware payload (Dridex)", "value": "5e9a66cfd73b44f4954c6376b320943de10da40ae625d8caa238b5a27ffdd53c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942592, "uuid": "6b95e54f-176b-4d99-b527-00a315ff7bfb", "comment": "Malware payload (Dridex)", "value": "58431d509af9c6e1bcfeaea1848313545c94be9f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942592, "uuid": "df4521c2-04ca-421c-82d1-a56a844db940", "comment": "Malware payload (Dridex)", "value": "ad1fcab5c1a130722ae970774411f1f90f8f6fd93debbf60a384d2b2294c2479c839df54dd103c5fc103407ed22bc2c4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942592, "uuid": "ac110f40-4663-4ce1-9f7b-c33917627083", "value": "EEF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942592, "uuid": "30d55432-29d1-4fb2-850b-e645695e54d2", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942592, "uuid": "55a6059d-9a0f-420c-ad32-4fac08c48b11", "value": "3072:MwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:MwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618942592, "uuid": "fe0f41dd-469b-48f7-b801-619c7d9694e9", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618942592, "uuid": "a0c01ba5-1539-4fd0-805f-bb4881d45c10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942592, "uuid": "872269a6-456e-4dc8-9bda-4b3919193f8d", "value": "5e9a66cfd73b44f4954c6376b320943de10da40ae625d8caa238b5a27ffdd53c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b91ba0-a229-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618958429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958429, "uuid": "23fd1571-2533-485e-a7c2-9233d04a8867", "comment": "Malware payload (Dridex)", "value": "10be3acbd23ed82bd185e6defe8b4d56", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958429, "uuid": "0987657e-c989-488e-9574-66461cb6632f", "comment": "Malware payload (Dridex)", "value": "5ebb20da56c03c88e074ddf5923e4aa7ab21de823714f8895e89d6a8e7eda6b2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958429, "uuid": "e92399ac-dc82-4b33-a900-6293b8835f65", "comment": "Malware payload (Dridex)", "value": "536040f744a961b9e27a137dac47d6d728bc21ff", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618958429, "uuid": "c89d032c-d2fb-455b-b55c-c276ee530897", "comment": "Malware payload (Dridex)", "value": "0718abcfe2f28f3f499a8d7b30733dc16cb219a9808fe6aa3a40e856a9bfdb0c19474426bd15e1777e53f36d8cb5b8b8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958429, "uuid": "cccb73cd-5769-4f07-898d-94388fa1fa1a", "value": "D4F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958429, "uuid": "0d4c02f3-3435-4cca-8291-5b1ce7948715", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958429, "uuid": "bf29ed0e-f9ec-45dd-9e31-2d5387f764de", "value": "3072:JwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:JwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618958429, "uuid": "730e59a0-bdc4-4679-a20b-0d113e0a3f25", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618958429, "uuid": "d81cb3e9-3fc6-41ed-9502-21ae4ebd3a22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618958429, "uuid": "05e47897-8f24-488f-a137-7ce1e7566a9a", "value": "5ebb20da56c03c88e074ddf5923e4aa7ab21de823714f8895e89d6a8e7eda6b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4296c37d-a1f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618934743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618934743, "uuid": "6af457d2-d625-4342-bb2f-af42af803f38", "comment": "Malware payload (Dridex)", "value": "4b072f555ac1c5dcbd97f48c64240426", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618934743, "uuid": "c8cd446b-bfd9-482f-a40c-23a5eee0d4b6", "comment": "Malware payload (Dridex)", "value": "5f03ae33bc256df6ba6f097c060411a039fb427310c0fd0735d67e029e51c155", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618934743, "uuid": "1d531e49-2ff9-44a4-bcd4-e951da66ff6a", "comment": "Malware payload (Dridex)", "value": "97ad102faf54a74644e205eb15cdc32f6bd56b4b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618934743, "uuid": "3ad44617-cd3f-4ab8-a9a3-233c137dbbd8", "comment": "Malware payload (Dridex)", "value": "72eb9b46431865a4d153ebdf3c57d795ed93153e0c01e6bcdf8879eef1628a2aca2a5a105715592e49c3510a153d34f6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618934743, "uuid": "50232d47-ba12-40d1-bf0b-369c7bed310f", "value": "C5F3D088CBB3E4E6EFB3D37866F85E1B561574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618934743, "uuid": "89bd81c9-883b-4742-bcda-03d66ab61d47", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618934743, "uuid": "bd89fe02-cc36-41b9-b27b-11fb7cb856f8", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618934743, "uuid": "6c0a927a-ea3c-4037-a255-20bd4b49ecb2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618934743, "uuid": "c43e684f-9a25-4fb3-ad67-202444a8deae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618934743, "uuid": "0973cb4f-d4b9-4f78-9caa-6636fa0e9fa5", "value": "5f03ae33bc256df6ba6f097c060411a039fb427310c0fd0735d67e029e51c155", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e6dcd4-a19d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618898166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898166, "uuid": "5ab4254e-cc64-4442-bc6c-0407f7fcb262", "comment": "Malware payload (AgentTesla)", "value": "f238c21f752fad35576c56be1e26cde4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898166, "uuid": "54464bfa-a45a-41ad-8f75-6d7040c3c2cf", "comment": "Malware payload (AgentTesla)", "value": "5f4944e7341f67f64359af367c857d6279727cc2d86a7e07397bd8ea187a2c4f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898166, "uuid": "9750c2c6-2521-4cd0-a91d-d6edb48f90ba", "comment": "Malware payload (AgentTesla)", "value": "4b49195c606738f760d1f6fdd579e4e2d4baf0b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898166, "uuid": "4299222a-fa6e-4f53-bb7c-2521037b871d", "comment": "Malware payload (AgentTesla)", "value": "05c9d0a87e68744a22c09145f564848cceb7cab04375a268eef162fd009929b0d36edf713a8b74b3a522f4eac616a7da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898166, "uuid": "4637952d-e4f3-4ea1-b4fc-81c9212523e1", "value": "95E423D432AF7766C08629660825DF74F65CE5FC0338C046AA1A71A70BD4FAFC60B5DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898166, "uuid": "386ed903-f644-44fc-984a-7cb6f8ffd911", "value": "12288:Fq0I5LCaugPyvhpH1m5h4hZSFCE3iyrI+CYY658kmDpq4EfokZuHIwdQf:002LFtPyvhBU5h4SFCETqYY623DpqKkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618898166, "uuid": "34ac54ac-aaae-40ee-ae94-9eadaf337244", "value": 657983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618898166, "uuid": "6a9b55c9-6140-4392-932b-c9899f8212d7", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898166, "uuid": "bf395582-238e-46f2-90e7-f51460c11623", "value": "PAYMENT COPY.ARJ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36fd94c1-a1e2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618927852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618927852, "uuid": "d6bc629f-a456-4e38-888c-44a19570a87b", "comment": "Malware payload (Dridex)", "value": "fe7af935c87eaaa5a25f06b71715eb7a", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618927852, "uuid": "275f0ea4-dc42-4fac-b4a3-29dae3a7e722", "comment": "Malware payload (Dridex)", "value": "5f4ec052a733fa6e8c8e710422c36be39393f6c125c16a468e318236ab3377a3", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618927852, "uuid": "35332f75-2edd-451a-8e03-1fda42642920", "comment": "Malware payload (Dridex)", "value": "ce1f17914f89f5be1b37146fad96f90c9e2c3ac9", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618927852, "uuid": "1c3fe40a-a5c8-4b1a-9437-98c73b4a4f66", "comment": "Malware payload (Dridex)", "value": "207a77881ffad607d73d8e47e95616f9f51fd972240788d2a9b464280bf3a0d55092c9874321acee54122727a731a977", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618927852, "uuid": "a1f1100b-4890-4df7-9f93-e2581d0571b2", "value": "50F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618927852, "uuid": "38f1bcf6-04a9-4936-8e50-55befe682b1b", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618927852, "uuid": "e48bbab4-69e2-474c-9775-2cfda4dc6608", "value": "3072:Zlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Zlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618927852, "uuid": "fd273b12-c965-4a17-a871-96313007e3b8", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618927852, "uuid": "f84ceb30-e2a1-459b-a391-88de849c797c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618927852, "uuid": "827028e4-ebf7-4226-b3d7-135aa70f446d", "value": "5f4ec052a733fa6e8c8e710422c36be39393f6c125c16a468e318236ab3377a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d3e4f8-a16b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618876800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618876800, "uuid": "01852d51-ffaa-4559-95c4-463717872324", "comment": "Malware payload (Dridex)", "value": "81925c6ecb838cef64d6fa2d1acab883", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618876800, "uuid": "227aacb7-3243-432a-a5da-17cb9d18f16a", "comment": "Malware payload (Dridex)", "value": "5f6ecbac74042c7c00894f054713ae7e7e87635c512761a1ce58fb792aff2724", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618876800, "uuid": "7e7c1ff2-41fd-4af7-934c-25c10dd99275", "comment": "Malware payload (Dridex)", "value": "a27f966839fc3c13dec034ef23478d61e9010baf", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618876800, "uuid": "4d3369ec-a36e-4872-b18e-6a20664eac72", "comment": "Malware payload (Dridex)", "value": "e94e8f37bdaa37f6ab9cabcb438e52783b15d320f89dcdb670ff83ba75671fe997dd8943fd316e57f99fd5d18baae274", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618876800, "uuid": "2c0a0169-16bb-4a40-a407-3022126f3aaa", "value": "1AF3D091F25FE2CADC4618340139F77265FD89108B34CC75D61583AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618876800, "uuid": "5275b098-1423-44ce-92ae-ccc801ef4193", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618876800, "uuid": "1ebc31b0-b83d-4bea-9fec-d91a89e60aed", "value": "3072:hWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:h42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618876800, "uuid": "0e4e0e55-10f2-49c3-8aab-ecaa15c6b222", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618876800, "uuid": "ced64e64-2391-45d6-98d5-74226a1d1c8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618876800, "uuid": "f6dedec0-f5f8-4542-aef7-b9f183292c87", "value": "5f6ecbac74042c7c00894f054713ae7e7e87635c512761a1ce58fb792aff2724", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e713ab1d-a232-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618962507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962507, "uuid": "ff2ee44b-7031-4ee2-ad7b-67c1da5bc481", "comment": "Malware payload", "value": "896c89b2fdd804eac3b852a535efaa67", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962507, "uuid": "3cf9de1a-df7a-4fad-b62d-3839978aa39f", "comment": "Malware payload", "value": "5f76814b1628f1d761d7e5c1bbfa17332c0ca3ba0dcd68bc48bdfa0ccd57630c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962507, "uuid": "b3c97830-2dfd-46be-9466-9b2e6c8ccaa1", "comment": "Malware payload", "value": "25592b161554d81f87f9d5061ffbc11b1b2e3c34", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618962507, "uuid": "18b08960-d564-4b3a-b00e-6910e99f9b95", "comment": "Malware payload", "value": "6ade816779c1ec8e31a9a052a964f21f35f865286cbcbe483d599a0bae8e2b6de573aa7e09bfa493cf18bbb3ff5b908a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962507, "uuid": "b0fb5523-3e53-4de1-bc78-df5370a9417d", "value": "85F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962507, "uuid": "2a41aaf5-94d1-454e-8c95-ba953f92aa62", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962507, "uuid": "2cf1eca8-b119-48a4-8c50-4fd7e6efa698", "value": "3072:XwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:XwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618962507, "uuid": "54e8d08a-e471-4430-b6a4-4f5e15082057", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618962507, "uuid": "ed6aada0-55e7-42b8-b4e3-4d2184beaa83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618962507, "uuid": "73d6a423-6a54-49b7-8d86-93130cce21d0", "value": "5f76814b1628f1d761d7e5c1bbfa17332c0ca3ba0dcd68bc48bdfa0ccd57630c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe71a99d-a1d0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618920455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920455, "uuid": "c6b10f84-f3fe-40da-b435-40e00a6c71cf", "comment": "Malware payload (Dridex)", "value": "d6599c638d7f69c3d0501df6227adb9d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920455, "uuid": "5a2c0ccc-05f8-4898-aeac-4ca40988cbd4", "comment": "Malware payload (Dridex)", "value": "5f7cc0f9f169e4451de8c73c739ceeffb75757dc6b504047739f464f7e53d83c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920455, "uuid": "0f57a6ca-24d2-4fbc-ae9d-e2f7b4f3eeae", "comment": "Malware payload (Dridex)", "value": "592980847618c6deedf7bb10c80140712756eefd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920455, "uuid": "0974e9c0-b2e5-4b10-ae59-e5385b64d9bc", "comment": "Malware payload (Dridex)", "value": "ef2564b50e0d922c5e87aef45e687a9a7f2ea6de90fd10fccf5cb5cf3175fd19c7f375543dcf6381c5ad90aab9f7a2d7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920455, "uuid": "381c1e6e-6119-46c5-8807-a7116cb0f72a", "value": "EBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920455, "uuid": "39013481-7532-4d75-bff6-c227e47c4dff", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920455, "uuid": "7afd7eba-e42e-4c14-bd39-3f5b00991cca", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618920455, "uuid": "f9407f65-b9e4-4a60-8275-2df7a3810afa", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618920455, "uuid": "256c1f13-0b55-4855-b495-471b41eb66c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920455, "uuid": "0fe9d4c3-bcb0-4a56-bf24-1100627e1ef1", "value": "5f7cc0f9f169e4451de8c73c739ceeffb75757dc6b504047739f464f7e53d83c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb05fe6-a200-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618941013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941013, "uuid": "8ba9aadf-f655-45e2-9087-dbee6bf69890", "comment": "Malware payload (Dridex)", "value": "760424ac6258361489bba8ea11800720", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941013, "uuid": "89523e2f-e0cb-4e00-b462-2e5e7fa9b462", "comment": "Malware payload (Dridex)", "value": "5facc7add67f614d54148c73b3ee439d70cda33b44e6421cfb26964ed66a6d49", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941013, "uuid": "81aab8c7-30ec-4be1-90ec-6ab3a17f641d", "comment": "Malware payload (Dridex)", "value": "31bb643f0907a454a3be04df98470bb0dc16a1c1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941013, "uuid": "dfca2b70-ef37-41de-836a-238a55b503c1", "comment": "Malware payload (Dridex)", "value": "993e299855debb59692e93b0846dcd89b3443d37940ef9ad2b177b876a959d80797a485beb9b7b1e52696711542e0f34", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941013, "uuid": "45d4b4bb-3840-4112-82d8-90a82b57b4ec", "value": "62F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941013, "uuid": "f9c1d43f-805e-4445-a519-14a25db722d3", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941013, "uuid": "037ab332-fac5-45ab-b809-44db42b0a5de", "value": "3072:HwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:HwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618941013, "uuid": "2e03c910-a822-4f6b-b9df-a9baa0df56e5", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618941013, "uuid": "d2c100da-f43c-468a-8292-02cea5fd7661", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941013, "uuid": "5d260bdb-0f6b-44d0-a229-182ce72a3ba6", "value": "5facc7add67f614d54148c73b3ee439d70cda33b44e6421cfb26964ed66a6d49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64bc59e4-a201-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618941243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941243, "uuid": "dee1cae0-74a6-4418-9e8d-3903b4608729", "comment": "Malware payload (Dridex)", "value": "25047747e206fa2b836373789e6e52bd", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941243, "uuid": "9dd11935-c2db-4aa3-a56a-b37a688aabc5", "comment": "Malware payload (Dridex)", "value": "601284fef5d35ceaef02ed46512da8f4ce6c89507c9a6fe9a8c2f488e1e86890", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941243, "uuid": "6c942860-41bf-49d4-958b-50bf07b9f768", "comment": "Malware payload (Dridex)", "value": "62461a77e187cbb37c68c189f6db8bb1a2788da9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941243, "uuid": "3176e0ac-74ae-4894-bd5b-13062b9d3c71", "comment": "Malware payload (Dridex)", "value": "51fc71151a283cf684838f02f1bf0311251eea7e9fa471db7b9996211c57cadf0951ad04c09dc8a269894c0be193b4a0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941243, "uuid": "0f88eb6b-08d1-43d2-b0e8-0d6aad8155fa", "value": "DAF3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941243, "uuid": "ae947623-238f-4236-a1d9-29c1bdc0e163", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941243, "uuid": "791f4a5a-10af-4ee1-af12-171ebb62a436", "value": "3072:5wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:5wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618941243, "uuid": "e76c4eae-d4a7-41e7-869e-56c8f1edf5eb", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618941243, "uuid": "1d63446b-166c-440a-86a1-1b80851a72d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941243, "uuid": "d5624b01-2e22-45d5-bccc-3a300e761995", "value": "601284fef5d35ceaef02ed46512da8f4ce6c89507c9a6fe9a8c2f488e1e86890", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b62500-a1a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618903293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618903293, "uuid": "7d16b67b-ba47-4a4f-9dc0-57abdbb009eb", "comment": "Malware payload (Dridex)", "value": "7faa76f11a32b5461daea051d456268f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618903293, "uuid": "4acfa5aa-8dc8-4b9c-aa28-c9da3d29b9de", "comment": "Malware payload (Dridex)", "value": "602790e695ecdff9f9218b616361e3a642a8f78cac2c2d904e7859e3e8c53367", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618903293, "uuid": "e629af77-4cfa-4c52-99cd-64fcf2af010e", "comment": "Malware payload (Dridex)", "value": "b0e4fc5f882d1053aa1e971694fc7b2937a7ce1c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618903293, "uuid": "b8691629-4c89-4c76-8044-2a43637a65ac", "comment": "Malware payload (Dridex)", "value": "6d562190ed8c7ecfd1c2b33bac140245e97b3172d17f80a35ca0fb4476254b49964518afd402941710405099985f5c58", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618903293, "uuid": "ada237d4-b64c-46b7-8d2f-dfcb1f72aa7d", "value": "AEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618903293, "uuid": "d5282f3e-b9bd-449a-9eba-a35b8736983a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618903293, "uuid": "8d56266d-43cc-4144-bda4-6dc437a5cf1f", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618903293, "uuid": "41284afd-e087-4912-89f1-853bed8329b4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618903293, "uuid": "133b352c-e02a-49cb-af5e-b506a6eeb162", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618903293, "uuid": "4126020c-a1fe-49f0-889b-ba726a7e6699", "value": "602790e695ecdff9f9218b616361e3a642a8f78cac2c2d904e7859e3e8c53367", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24387e16-a1ae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618905486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618905486, "uuid": "658a7364-8e65-429c-9385-a400f73cecc0", "comment": "Malware payload (Dridex)", "value": "68a3e025905a0dbad16215fb4c6d1bbd", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618905486, "uuid": "6bd408a9-f673-426d-bb63-be6381980184", "comment": "Malware payload (Dridex)", "value": "602e1669c4d4fcf37ec11a1851afd45643b856c13d7d59ddf08247ef2620aa01", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618905486, "uuid": "6080f92d-4f89-439e-8adb-5fedd1503b6c", "comment": "Malware payload (Dridex)", "value": "b3217344d89e6595427bea64345230c32254f825", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618905486, "uuid": "1d8b7ac4-a5f8-49dc-82f1-296de85fde05", "comment": "Malware payload (Dridex)", "value": "1b8463ccac882368c5b3644fdf8c2d322dd24ebe1d48d051033d4c85c48c431bb556a5c4d3674c642c24b82396613d9b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618905486, "uuid": "b131e155-72bb-42f1-a8f0-1800fa40b975", "value": "E3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618905486, "uuid": "d4080a96-32a1-4646-baf0-ec386dadfeee", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618905486, "uuid": "96fc59d1-7914-49c4-916c-718f1c0dfe8e", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618905486, "uuid": "f0c30685-f9df-46a4-9138-000e5241476b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618905486, "uuid": "488efc1c-cdf7-4e73-903b-09db2ab0696d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618905486, "uuid": "2564b9a6-12ad-402a-80a9-f363cf92eb09", "value": "602e1669c4d4fcf37ec11a1851afd45643b856c13d7d59ddf08247ef2620aa01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad870b68-a173-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618880376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618880376, "uuid": "a133f515-9cc1-40d7-807b-fff780c966d1", "comment": "Malware payload (Dridex)", "value": "25e4f1fea71f1f5753c8a53654b6c725", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618880376, "uuid": "cd4e7319-01d9-4550-845a-68469914157d", "comment": "Malware payload (Dridex)", "value": "60999d9b1011cdc01990e4600f5c1fca9c30ee17c76f0c40b3107f57a08a954f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618880376, "uuid": "e49da9ec-d190-416a-8aff-48869d98bf16", "comment": "Malware payload (Dridex)", "value": "73b8b7d64c9975a1865547013c246303d5fad1d1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618880376, "uuid": "84238d9d-95ed-4b70-9a0a-c927be6e1365", "comment": "Malware payload (Dridex)", "value": "5d3d4589e156beac85767daf4f0b02d176762d144382e4d12e55145f957357913abf918a96aac1a8f3456bbc888e40ca", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618880376, "uuid": "92fef4d9-aecd-4227-80ce-70804cad62bf", "value": "99F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618880376, "uuid": "ad3d3a41-33f9-4a79-90c2-ed4651f5f136", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618880376, "uuid": "be125c2b-d893-497a-9c14-1cb47d929be6", "value": "3072:0mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:03Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618880376, "uuid": "8b257f69-e3b7-445b-aa3e-3cc0033ff591", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618880376, "uuid": "e84bfaf2-03b8-4b2a-a49a-c9e2f4bc11a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618880376, "uuid": "c60cf4fc-5ed8-4d82-8ed0-a2f7260112fe", "value": "60999d9b1011cdc01990e4600f5c1fca9c30ee17c76f0c40b3107f57a08a954f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c472ea-a211-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948014, "uuid": "38412a2b-f8bf-4bc2-9c62-77606ef1b631", "comment": "Malware payload (Dridex)", "value": "92c2daa0d5657f7d7b43e57164a177a4", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948014, "uuid": "e2d8c44f-68e2-4d5a-83c1-b7f5ce06a7f8", "comment": "Malware payload (Dridex)", "value": "60bde6daacacc9274cd44999b0da07307c4c574ddb27936b47135df4cdfd0eaf", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948014, "uuid": "9465a9f1-21d8-43f2-8aa2-59c401bfc9d2", "comment": "Malware payload (Dridex)", "value": "ce4281a595ea06fd0391bf87c27f7a3ebedab464", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948014, "uuid": "532ed09f-6592-4829-9561-f6cd4d07f13c", "comment": "Malware payload (Dridex)", "value": "23053d1ef87c8c5577b4a5b4c3d9cc03769ea175194490ce240f3382bd31978f80fd0b59a30ad1d692c9d21cf7573350", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948014, "uuid": "9f03c871-1bc5-4460-ab5d-1c803d1189c2", "value": "3DF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948014, "uuid": "44d9b61c-35a4-4567-ad86-b5c181f817a9", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948014, "uuid": "4d1ee761-ae4d-42e4-b5c5-9565ede0bd4c", "value": "3072:Plpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Plo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948014, "uuid": "2603d249-2e26-46ef-aa85-3ef8059f45f7", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948014, "uuid": "96f066c7-abdc-4cc6-938f-7903218a60b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948014, "uuid": "7426e4f4-19b1-4747-ba21-e24d8086118f", "value": "60bde6daacacc9274cd44999b0da07307c4c574ddb27936b47135df4cdfd0eaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c35cd59b-a212-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948703, "uuid": "3ba0ba9e-c604-4a89-90e5-03969193f0de", "comment": "Malware payload (Dridex)", "value": "65623f17947dc25cff4f1d0f3c3978af", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948703, "uuid": "e488e5ce-a5c4-4535-913b-5a3b924a894d", "comment": "Malware payload (Dridex)", "value": "60e237606943db97cd93884aa9a2fb7881a186f9a59125fd7871ed5ba82c8dbc", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948703, "uuid": "a0079c62-643a-4268-87b0-1447c776f450", "comment": "Malware payload (Dridex)", "value": "fffb09a94191a86e4b0a45abbba62808fa192d57", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948703, "uuid": "19332001-617f-4bf5-8a45-4c78ad13b27d", "comment": "Malware payload (Dridex)", "value": "1a572ec48abc07c12e245039d983db08f7ab3e705ff05813242dfc54bcf74a036b8d1201c63ef47c49a458c688492e4c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948703, "uuid": "bfe4b80b-6626-4499-9da1-5e6fcbbc743b", "value": "48F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948703, "uuid": "86a45fc6-7cd7-49a1-bcf2-f7df94a8c967", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948703, "uuid": "70dc70a2-8798-4d06-a68f-3d9f87826580", "value": "3072:awZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:awZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948703, "uuid": "711019d6-b29b-499f-9965-ce24f474619a", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948703, "uuid": "6f6c85f0-c6d8-42e9-8c24-ede3db264998", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948703, "uuid": "b8cc5bbb-76cd-43d9-bcb5-7543bc3a3c63", "value": "60e237606943db97cd93884aa9a2fb7881a186f9a59125fd7871ed5ba82c8dbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631edec0-a215-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618949830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949830, "uuid": "155ebb08-52da-4e23-bae9-7aea85d92e78", "comment": "Malware payload (Dridex)", "value": "75f93be18cc97f7942a14c60a0467055", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949830, "uuid": "6fdc2664-0fa7-4d35-9695-2d44cc969ef9", "comment": "Malware payload (Dridex)", "value": "60eab837da67af87e4c2fdc9bce5d7183e142d716798c6b53848c4200fea2101", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949830, "uuid": "d267d838-2900-4fba-95ed-39b6f04f27c2", "comment": "Malware payload (Dridex)", "value": "8d471d59ff162186bf48f4e3d146894eaacf9fad", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949830, "uuid": "a1b38af5-f087-44e9-91a6-f655ed428866", "comment": "Malware payload (Dridex)", "value": "c4d50b0d9c06a38fe149d46d849097c217f100d2a8aa4ab4d587615a57a47634adcc2b1caac56f5ed0140947371229d9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949830, "uuid": "b05c9071-6d2b-406b-9338-761810c88dc4", "value": "03F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949830, "uuid": "4f5909d7-60ed-4075-949f-c8a17658dbb8", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949830, "uuid": "e612e7eb-e1e6-416e-ac90-86f33c92e32b", "value": "3072:3wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:3wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618949830, "uuid": "b698fac3-654f-4092-b11f-9049b18bcf20", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618949830, "uuid": "61f0b45d-526e-4f67-a727-5192062b6d8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949830, "uuid": "1b3d1710-df37-4c67-a0a2-b457b2f87a3a", "value": "60eab837da67af87e4c2fdc9bce5d7183e142d716798c6b53848c4200fea2101", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a6ef92-a19c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618897842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897842, "uuid": "94069c12-eab5-4db0-a46d-d5c995812a31", "comment": "Malware payload (Dridex)", "value": "30b88ab7aea5931f2800721e8d65b320", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897842, "uuid": "0267669c-cd9b-4d6f-ad3d-c5de1652a8dc", "comment": "Malware payload (Dridex)", "value": "61072779af4079360fbff4d6ffbc362bd638b75c72103415b882cdc889ec3725", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897842, "uuid": "f2ba2714-8806-4722-8dc5-a75e25006fbd", "comment": "Malware payload (Dridex)", "value": "df4d5d2ad2342ce10dc7073a31aaddcca3b690e9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897842, "uuid": "a95d5442-d731-485c-ae4c-31dd226ba00d", "comment": "Malware payload (Dridex)", "value": "3e25fe4c6e15f6c82d7bc8ae1546ac847e2c5b7914fbd3e44dd2a98f83fd20b2fb868e04560968f85644f8dc5afb42f7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897842, "uuid": "8b85013f-74d2-421d-b3b4-97fcfe930af0", "value": "6DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897842, "uuid": "f63de488-a118-45ee-80b3-3e34785d74cd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897842, "uuid": "82d55ea5-6fc7-489c-9dd0-ed8e486c7a57", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618897842, "uuid": "4360a529-12e0-4c11-a19b-3d6b2b012233", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618897842, "uuid": "3d1a12d9-54b8-40b3-99ad-687c46599cbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897842, "uuid": "af9ce25b-d3e3-4ce2-ae5f-6aa543df2a57", "value": "61072779af4079360fbff4d6ffbc362bd638b75c72103415b882cdc889ec3725", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3dc902d-a1c9-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1618917324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618917324, "uuid": "41973869-6dac-4b2f-874c-dbf5b8b1eef1", "comment": "Malware payload (STRRAT)", "value": "20e131d47d02df6ee39aef32a059b841", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618917324, "uuid": "d283efd8-9c21-45c9-96e1-4e8e33e1b41f", "comment": "Malware payload (STRRAT)", "value": "610bce46162ef33ab1af1e3962e720374f3505064de9fd92c9ed9f1f0b2c8e91", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618917324, "uuid": "6749860d-e071-4b27-a4b6-61745f43fc20", "comment": "Malware payload (STRRAT)", "value": "7a015f20fd4249787ea9c0593f786837913e340e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618917324, "uuid": "ee87e80e-0f35-4e7d-9d3f-09b3b7500964", "comment": "Malware payload (STRRAT)", "value": "08600c40ffb99ecd271749fa5500497108e3b5534e3653ada744e1a13663c840f40d617835257b4b2681e2265fcbcf5e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618917324, "uuid": "ea8f7d75-8fee-4d8e-9327-eed1a07dad4a", "value": "03A3D01BAEAAC6E0F81B5537141A5232E60D415AD03F613F36FC148A0CB6DAD4716EEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618917324, "uuid": "6e5e1716-0a5e-40e7-b888-c32e8b105ea5", "value": "1536:M+Kh5EanHUXtXNdPkSgGtimN0KCWwYkzknKhEVRvXMd4txnrRg+pKlOTrvij8sA:ZcEk+t/PkSplZCskohzi4txnlKkTjVsA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618917324, "uuid": "3976b1a5-75f3-4921-ba70-4736c074f093", "value": 106261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618917324, "uuid": "fa0552d0-4f09-4662-a728-89a4406e7b1d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618917324, "uuid": "92249382-ffee-4171-a561-6ecf24d80d07", "value": "DHL SHIPPING DOCUMENT.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a852c89-a1a1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618899940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618899940, "uuid": "81ad0941-2fd5-432a-a0d8-10ca279325b6", "comment": "Malware payload (Dridex)", "value": "027c380c2aecbe25c79822538b7a09e9", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618899940, "uuid": "b9eb8a05-d67f-4db0-b3a5-28967c4444a2", "comment": "Malware payload (Dridex)", "value": "612701f769588b756b27ea9da8cfad4f50506e2da97abe056914223092de740a", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618899940, "uuid": "246cba62-8fd0-4d6e-92c5-6544266f2259", "comment": "Malware payload (Dridex)", "value": "69a50a03d8e566911e9c33ca31a439f9cbd543f4", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618899940, "uuid": "6f3bc5b0-bd7d-462d-90a6-62ff701283d9", "comment": "Malware payload (Dridex)", "value": "8f62ac7e0d8d0e894c6dd871570947da27b9c673e09f88f1eb820df79f2d37e97a88e158eec1bf43efb88569749f3a88", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618899940, "uuid": "47b9f568-7d22-4218-84df-dab0ab20d8d6", "value": "BBF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618899940, "uuid": "07d6fedc-6fbd-4144-81f2-fdbfbd8d2a04", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618899940, "uuid": "c6136557-473b-4923-b589-33409eeb1c19", "value": "3072:2WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:242IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618899940, "uuid": "7f04b385-9f39-4a3a-8c1e-81af3eb82726", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618899940, "uuid": "0c7732cb-b1bb-428f-bd11-65c6d2c4e685", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618899940, "uuid": "01c745fe-881b-464b-ab88-a3e6116f44f8", "value": "612701f769588b756b27ea9da8cfad4f50506e2da97abe056914223092de740a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26801bfd-a1d0-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1618920093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920093, "uuid": "71e818d5-37f4-47e3-baba-09576b0d85bf", "comment": "Malware payload (ArkeiStealer)", "value": "542f3ea693d61187bd10db0376a6b3e7", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920093, "uuid": "6ce9e5a4-d653-4f50-ba7d-37d067fc967c", "comment": "Malware payload (ArkeiStealer)", "value": "614ea8187654128fc27a51455ab3c8fdbb6d398382cd4d825cf795dbbf5d7966", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920093, "uuid": "43c42952-b8cb-42dd-939d-7a9ae4f3854f", "comment": "Malware payload (ArkeiStealer)", "value": "92409ffc8c6ea0ae55a76b6b15616f75174dba97", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920093, "uuid": "1d31ba9d-1028-46e1-985f-262abd0b83d3", "comment": "Malware payload (ArkeiStealer)", "value": "3da6395a583a915d4b3bbd4a827eedd23c755de297aa5df530cd8eedea0c34ad32b2458aab2b1374fd2d0effee7dc4e8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920093, "uuid": "31da2976-764f-4cd9-80e2-edc0e03fe450", "value": "2F4412802E55C338C494DE71EE32811096B0AD0FAE7181D7E91CBF5FB57928CF69867A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920093, "uuid": "2d0c7df8-49d5-4ca6-bef6-61b149e98996", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920093, "uuid": "8bbf8204-8bcc-483b-b7a8-19ee97b17c5c", "value": "6144:/tfUeAIQHuA36cd+7Zqy9emlZSoKgF1s2Q:/eeAItC664FHDpX1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618920093, "uuid": "c4ca6c3c-4735-443d-a82c-0e949dfe8c69", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618920093, "uuid": "b1688518-ed64-46e4-9f27-fd1d6531261d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920093, "uuid": "8e3bf49e-87a9-4df4-b8ab-591dbc85e9e1", "value": "542f3ea693d61187bd10db0376a6b3e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13310d44-a211-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618947978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947978, "uuid": "12ee55df-4fe7-4c82-94be-9799999f5437", "comment": "Malware payload (AgentTesla)", "value": "4f00b5cf97c974ff79e0af313c66b80a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947978, "uuid": "9b5e5872-ca74-4d3a-9ca2-323ee40e342e", "comment": "Malware payload (AgentTesla)", "value": "61880c6c512b8c74e89d154ae3b3f0d29ba65eeb79600056e22e40097bee0d9b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947978, "uuid": "11555fda-9228-4bef-9201-045398d58cf3", "comment": "Malware payload (AgentTesla)", "value": "5cafe95afb00b18c1aea5974b70acd71168bf218", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947978, "uuid": "d5ca8e72-8d01-4f6f-8817-177458c5048a", "comment": "Malware payload (AgentTesla)", "value": "a9e512a2be46bc78c09d3067d243ab760d139ea29f2947afbb4127aa6e6086ecd9bacfc38bab300fdedba441c08bdc0d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947978, "uuid": "7541c1b4-c825-4b38-92fa-b7bfdf1d3886", "value": "E5F4DF2DA7894D14E73EB3B90721E24083B4AD3A16CAD21EF9F634B62D32E43475745E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947978, "uuid": "15bb02be-24a4-4ab4-8a5b-d93f27a498bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947978, "uuid": "a91b8712-367e-4b7f-893b-ff38a34307b6", "value": "12288:yvoF7WMiT3b8TNL9mGoQe53zBKQ6ptCxBCKbXYofKaQ0QospfzRRRRR0Z71:yvu7WMo8TNMGbe53Q168Co6KaAvRRRRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618947978, "uuid": "f76e2281-cbe4-42c5-b130-03fb9814f582", "value": 723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618947978, "uuid": "897e09af-6c7b-416b-add1-3f9c1ed531b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947978, "uuid": "eb4ed6e4-b3e9-4454-b0c2-7fff4138d2cd", "value": "7yA5YX9EI1Sm2rn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1115c65d-a1c8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618916621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916621, "uuid": "ed5ec27a-f594-4369-8513-f21b4578c5e8", "comment": "Malware payload (AgentTesla)", "value": "74c9d0d03b7c3ce4033754f8d3b61de2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916621, "uuid": "2e4098ed-31af-4509-abc5-26b04c57009a", "comment": "Malware payload (AgentTesla)", "value": "61e0278a3ba7248b04942441113aa92aecdd5f4f51b93d0e431048f195024971", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916621, "uuid": "ad8a266f-2d60-4302-a801-c85b876f8258", "comment": "Malware payload (AgentTesla)", "value": "965852abf4c0a13fa909c24f1f6a41ee26c90510", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916621, "uuid": "81488b7b-2453-450e-b70b-cb6c1c30ab82", "comment": "Malware payload (AgentTesla)", "value": "dffb0ee2e7b49c78f55fa3014ec907f121f9db20a828b335a6401e4b37fe1461fa82b9f776a2625f2130e06d162e2102", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916621, "uuid": "ff9705bd-d131-403e-b7e3-44d72c5544c1", "value": "7074AEF875047DE62A6F576BDA96ACEC03B6276389CBA4CD806477C305A3375EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916621, "uuid": "8af53c5d-31e3-44c8-a83f-e07fb9b6cc5b", "value": "6144:n181AlVNiq3wgVYsyomDlT5FxU9Dh8l91+bEuq0XLFJ1QVdXy5Fl6L3OXAycyKB0:n18ylVNJAgVcogltFaMJw5LJUk5Fo3Zs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618916621, "uuid": "7e322f23-79af-4c53-bce0-4bff6288aa4b", "value": 348829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618916621, "uuid": "e0512bb7-a57b-4d35-bb71-bfdede558550", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916621, "uuid": "cbb1e54d-22c4-4995-8348-567a16608392", "value": "New Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad832186-a1d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618920749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920749, "uuid": "fd0735a3-d36c-4858-afaa-566519fba09c", "comment": "Malware payload (AgentTesla)", "value": "230176dd9c90e941cb413b2c00446c3b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920749, "uuid": "b93baa76-d624-4723-9e95-24ffdfc3f671", "comment": "Malware payload (AgentTesla)", "value": "61e6f5e7ac07ab1b9aa307b1f1feb3be8042a9440dfcdfdcfc6e710e3b0288d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920749, "uuid": "e373f3d6-6a7e-48fd-a6e3-6af3235c440d", "comment": "Malware payload (AgentTesla)", "value": "9fe680fae77111fed15c897b9ca7bd5f3e39d0d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618920749, "uuid": "b5b12007-3409-4a37-a453-c4ab08055ec0", "comment": "Malware payload (AgentTesla)", "value": "6cb92696d9d961e66488a736a86467ac756e1e76288fc3b45808f20d23daf4aa37aad5b6d810d82d77f06dc2997304cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920749, "uuid": "9c45e0a5-817b-440f-a217-fec250ff597a", "value": "62C25C94E2891D13C42D6D79B4F2390437729BE61E05E6AB6E4DC0D49E033CF8A6C6AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920749, "uuid": "32df9796-5a2e-401f-9278-de811717484e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920749, "uuid": "190d8d9a-c107-441c-afe4-b7afff2f1649", "value": "384:ss1DTOPGJsLqQa9xlOYYFBoxD5IQNtTHaaNIUegLI5dd4WGaYb/98FAh:XDTOPCdYKOOtbV2U+j4WG9b/9Jh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618920749, "uuid": "3c1f5bff-7e5a-498e-a4b5-edae23a25dd4", "value": 27888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618920749, "uuid": "a3db6afd-34d7-4930-b9c5-3a878da0340c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618920749, "uuid": "b28b2cd3-8acc-48e8-b1a4-a391e5a59516", "value": "230176dd9c90e941cb413b2c00446c3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fcdb3c8-a231-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618961850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961850, "uuid": "b9334bd0-6061-4cf1-ad3a-790e15770800", "comment": "Malware payload", "value": "07ac26e8c6adc94a29d0d5ebce29e2c2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961850, "uuid": "bdb51873-ad3c-476a-88fc-4f970139d624", "comment": "Malware payload", "value": "61ff29a5cfe560e779fec21e6a9801b083ee5dcd9971951893d2f2d88629a6f9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961850, "uuid": "2692d63a-776d-4cff-b36c-7265b83f709f", "comment": "Malware payload", "value": "dc474070962037181bb17757947d335d7e7adf75", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961850, "uuid": "95027eee-433c-4abf-a0ab-26e9361549da", "comment": "Malware payload", "value": "aa714a38a87ac8521b1c1af30a26ce941e75cf5ce9812df709c2895953526023aa001d83af9b0bb831ea6d04583f0e8c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961850, "uuid": "456498f5-d610-40b4-a060-161ab9dd3759", "value": "DCF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961850, "uuid": "20e9a680-bd7d-4064-9489-c183e10e2319", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961850, "uuid": "5566dfef-d579-47a9-b8be-ccfa2e413b89", "value": "3072:FwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:FwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618961850, "uuid": "b38ef581-575f-43cb-bc78-9f6ee44780e8", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618961850, "uuid": "17a2e778-5992-4251-92b4-7918c776d055", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961850, "uuid": "dfbb8383-6074-4f62-a6eb-8684b54e2ffa", "value": "61ff29a5cfe560e779fec21e6a9801b083ee5dcd9971951893d2f2d88629a6f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617e6a60-a216-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618950257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950257, "uuid": "31c228f6-2cf7-48de-b47b-f9747fc970cc", "comment": "Malware payload (Dridex)", "value": "12ed856dbed040ab41ea8e8230516190", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950257, "uuid": "c6be1a2a-62d3-4f5f-9b0c-8a7c0e4a52a1", "comment": "Malware payload (Dridex)", "value": "62007602e7ab81e6986fa60aa86274d3d8a877a465f2c0fbf8eb9c51b21dffb2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950257, "uuid": "07c6e78a-435b-4c5c-a98c-b6c0a004fafe", "comment": "Malware payload (Dridex)", "value": "40b090849895c6121b64613b3ab3f42cba47c558", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950257, "uuid": "b4b98f3a-8e66-49fc-adbf-a5905ce69564", "comment": "Malware payload (Dridex)", "value": "3dab4d101a8d5e54efaeb18f5bf3f2a4ae20f602fb8cf7ae33044072c3a890d2d180e18c7bb167284b49ca7f6e40a262", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950257, "uuid": "0b55ea1e-e697-44a3-bd06-cd8fafffbc35", "value": "BFF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950257, "uuid": "5063d77b-d5cd-446b-93e3-c7351253c49e", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950257, "uuid": "78455ea7-631e-4197-a0b2-ade1e9757ed7", "value": "3072:2wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:2wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618950257, "uuid": "d4f6375c-4800-4399-8178-24c704e402f8", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618950257, "uuid": "cab23f51-c3b5-47ca-95a1-a48ee4986bc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950257, "uuid": "2ebeaaa7-8a91-4066-8ff8-3657019c4330", "value": "62007602e7ab81e6986fa60aa86274d3d8a877a465f2c0fbf8eb9c51b21dffb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d4fe35-a18c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618891051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618891051, "uuid": "79a72c2c-4057-4ddf-b04b-ce3560e109b1", "comment": "Malware payload (Dridex)", "value": "0c2f80a7d3db634f3acb9eb80771070a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618891051, "uuid": "7232f2f6-6c62-496d-80c3-df59ff489834", "comment": "Malware payload (Dridex)", "value": "620a3a0bc3e8a98b91d27c9bf1eba998e86d4b28b6b530f35a24364dcfa6a9b8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618891051, "uuid": "540cba8a-241b-44c7-9f91-a94e69ad2f04", "comment": "Malware payload (Dridex)", "value": "7244d7b13562e576e7724a09161d2f118f02426d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618891051, "uuid": "b6b6e1c4-101a-489a-b0a8-345b26bec849", "comment": "Malware payload (Dridex)", "value": "035748961e22813ffe8aece2855af6134c09b1f990c187af0777d19f7d1e1e7273410546d3bbba9c2dbc068c67237abe", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618891051, "uuid": "052fa10f-b0c9-4160-8111-ddb8fbc5843a", "value": "38F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618891051, "uuid": "76be67b3-9d29-4693-89a6-b05c1a5d0424", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618891051, "uuid": "59de74b1-473c-46ce-b4e3-9df24820cadf", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618891051, "uuid": "c7fb43d2-dd1b-4407-a47c-578e665d014c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618891051, "uuid": "f7bc02bf-cdde-4f19-8b45-e1541e7b8973", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618891051, "uuid": "1d506770-a47b-45f1-9f65-6dee6f23e7f1", "value": "620a3a0bc3e8a98b91d27c9bf1eba998e86d4b28b6b530f35a24364dcfa6a9b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517531ed-a1fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618939922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939922, "uuid": "06ba1efe-9716-4084-914c-c15e8c983ae5", "comment": "Malware payload (Dridex)", "value": "e4b6fdd9e3cf6e42505b1f06be03417a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939922, "uuid": "9cc8e082-6d36-41f1-8fd8-68d45cac91ec", "comment": "Malware payload (Dridex)", "value": "6212523f7503aae0cd7b381365091ace65d9b62a102a47d5f9f2329472aa4061", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939922, "uuid": "a27ebf83-d575-4a7f-ad02-d442b3d390aa", "comment": "Malware payload (Dridex)", "value": "42365a4572ba6c25ef68175b0715ce9dfa81952d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618939922, "uuid": "6ebfb33d-bb73-49d7-ba07-d89c96866362", "comment": "Malware payload (Dridex)", "value": "42ac51f39c1c7269817f4b5ec02c191e7235f7c6b32385c19a4087d5dc196b65abb111cfea4d02eec05cf586d5cc439c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939922, "uuid": "7be858fe-d5b3-400b-a1b2-985ed449f585", "value": "5DF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939922, "uuid": "de9cf310-2b62-48f4-807e-6e02b7d03bdb", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939922, "uuid": "b69c921d-dba8-4c09-b469-4dcf52cc85b2", "value": "3072:OwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:OwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618939922, "uuid": "a15d7d49-d246-4bdc-85ef-daf057d1fe82", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618939922, "uuid": "365e4de6-4692-4741-a738-d1aa67a660e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618939922, "uuid": "811e64ab-5024-4921-8d18-8eb241a43b97", "value": "6212523f7503aae0cd7b381365091ace65d9b62a102a47d5f9f2329472aa4061", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a52d37d-a19c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618897954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897954, "uuid": "48d976e7-dc35-4408-82ba-bc9149e53642", "comment": "Malware payload (Dridex)", "value": "25733be66417288fc7edb7acfc67fc44", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897954, "uuid": "ee808864-b619-4217-a61d-892aa8fbf2b3", "comment": "Malware payload (Dridex)", "value": "621885629bf9b8a2f16f6722fca6188052a288c7232c57be1b5242e9b9d8cdd9", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897954, "uuid": "1e6259db-f980-49dd-9aea-3aa1e55f4c6a", "comment": "Malware payload (Dridex)", "value": "c7109f8aeae5948494ebf66b2f5610fc2b0a3b85", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897954, "uuid": "4c9340b4-4162-48f4-9f49-42d4322ea436", "comment": "Malware payload (Dridex)", "value": "63a91a4896de59269f7514a788c1ae855258d97032b071a737170c5981b0bc2df4ab886802abd778010aa3c7082c7dfe", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897954, "uuid": "d9bc2f97-0485-42fa-8419-351b9d22076e", "value": "CEF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897954, "uuid": "ccb80c9a-e7e3-4983-8a75-189f9c022054", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897954, "uuid": "b52f20ee-0bed-4165-bd8f-73fa3bdb3b2e", "value": "3072:BiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:SeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618897954, "uuid": "59a822ef-d5a8-431a-b7b1-3cbb3082a6f9", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618897954, "uuid": "c639e6c5-121d-417a-8449-f4e401f1f675", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897954, "uuid": "a01e8ec1-fbd2-4cf7-bc57-e74e023d852d", "value": "621885629bf9b8a2f16f6722fca6188052a288c7232c57be1b5242e9b9d8cdd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd9ebab-a21f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618954061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954061, "uuid": "441b2dd2-00da-456e-803c-29849eb19ebc", "comment": "Malware payload (Dridex)", "value": "093fe9c56f436975815048981d5c811e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954061, "uuid": "9d3d5218-7b65-4c28-9fca-3ac2b7b6c789", "comment": "Malware payload (Dridex)", "value": "6235c54658576f191b97db3cc30157fe06a9abfecc0b788e77f05b0573779ae3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954061, "uuid": "bf53a570-a6dd-4600-b20a-d637844ef97d", "comment": "Malware payload (Dridex)", "value": "be40e87e0083dce34c2f375ff2c9a4bfd9a1b196", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618954061, "uuid": "afde7a20-86ef-43cd-9a8f-fcebbd192a02", "comment": "Malware payload (Dridex)", "value": "e20663e00b4a05bbd434ed1fefda93ec3e9b59b11fece16e412fdaffff36ff82b5afbd72fb55c3950e4811bb23f59736", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954061, "uuid": "1b1a125c-1b92-44d5-a3d6-df6ac7011283", "value": "78F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954061, "uuid": "dbc45b02-07c5-4389-abdf-811c8cf9458a", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954061, "uuid": "c1923f9f-cf31-4c30-a5f8-2671cb656bcd", "value": "3072:8wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:8wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618954061, "uuid": "1b2a7968-a20d-44d1-973c-4b7511283833", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618954061, "uuid": "28758954-586e-4ee6-9608-66131774a763", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618954061, "uuid": "89c60d5e-9275-4b53-8743-204bd759c03a", "value": "6235c54658576f191b97db3cc30157fe06a9abfecc0b788e77f05b0573779ae3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "672aa6a0-a203-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618942106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942106, "uuid": "6e7e7674-6ef0-410a-b7c0-758cb7ec037a", "comment": "Malware payload (Dridex)", "value": "40cd6731b15e8f20f6e740d3b3bb2924", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942106, "uuid": "19af1c4b-9592-4ff0-990d-c56bd5ce8b2e", "comment": "Malware payload (Dridex)", "value": "624c40196b01da2edc8fbc3d3db32a5386b9e7efa58ddfa522432b52c74c4f3e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942106, "uuid": "697b0863-7400-4d13-a369-6508f7987703", "comment": "Malware payload (Dridex)", "value": "047564c9b4f0773a407d83d526f2afdcd20c1dd7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942106, "uuid": "b6dc8a17-8e6a-45de-86dd-dac60a6a2c86", "comment": "Malware payload (Dridex)", "value": "ed3d27967a69e8efebb29dad8a0f7c246035c148ae74f177bca0b17cd67e487852330b7b34ff62fab8951fb22949cd2b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942106, "uuid": "04682c52-7f5a-426e-bbbf-ad82a9fd44ad", "value": "C9F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942106, "uuid": "a80ce81c-9a27-47ee-ad44-65b1120dc8d9", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942106, "uuid": "4b894751-66d8-4166-91c7-79e70061a3b9", "value": "3072:ewZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:ewZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618942106, "uuid": "e44e73a3-92f2-4267-bbd4-ddd53c257355", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618942106, "uuid": "f4d25106-a728-4999-bde3-6fb0f00a29bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942106, "uuid": "be11b37d-0c7d-4d50-ad9e-b82b9e925034", "value": "624c40196b01da2edc8fbc3d3db32a5386b9e7efa58ddfa522432b52c74c4f3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a870cee8-a212-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618948658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948658, "uuid": "c7b41043-25e8-4e32-8680-8b2255c9538e", "comment": "Malware payload (Dridex)", "value": "58235db0b4af3342783de8e4362e74c3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948658, "uuid": "c9714601-2356-4616-868b-4b15c486a0a4", "comment": "Malware payload (Dridex)", "value": "6260c3cd5b7525e51986ff4b246ea34794acce9b851824ebba837be9f56e0af4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948658, "uuid": "a4bca58d-d2cc-4834-830f-5883b913a7bb", "comment": "Malware payload (Dridex)", "value": "bde6f369ef217347f741007a721616bc96a8b058", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618948658, "uuid": "cb7ef226-a306-4cd8-ae64-7e2d83a6f52a", "comment": "Malware payload (Dridex)", "value": "c603bba54832753663a30e219a48441b2b763a3e10a2d009fe8da495228f4ba587bf5e4a3e85238a86b3cc67e48e419d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948658, "uuid": "4b1ec408-322e-43a5-bab5-40a9d36d5cd5", "value": "95F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948658, "uuid": "c78df37b-e147-4dae-ab3b-c72c89df0c21", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948658, "uuid": "3ae1f5ef-5703-4112-967d-3c9d9397aad0", "value": "3072:gwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:gwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618948658, "uuid": "269b660d-162d-429f-811d-63473d678636", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618948658, "uuid": "ba3b7f8c-3dbd-416f-b07f-27fa29c8f6b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618948658, "uuid": "dbb08e71-28bd-4248-8f3e-16cf9fbeb921", "value": "6260c3cd5b7525e51986ff4b246ea34794acce9b851824ebba837be9f56e0af4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a4c112-a20e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618947011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947011, "uuid": "c09b5ffd-7e5e-44e4-81e5-c24dcb5cad95", "comment": "Malware payload (Dridex)", "value": "c3981055e17c198a2904c33dffe7a67f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947011, "uuid": "e65faa37-53db-413f-8e4a-0ab61bb765ee", "comment": "Malware payload (Dridex)", "value": "628d41ca34fcbce679f292aa2ca5cbaf375c7de0005097238e803c1e60efa235", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947011, "uuid": "499b01bc-db5c-47a3-b39a-5a5be6a13e6f", "comment": "Malware payload (Dridex)", "value": "45df284574051f6b519371983bf80bb42dce87c4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947011, "uuid": "4eaf94f0-4b86-4001-80ea-fd755b9f4bd4", "comment": "Malware payload (Dridex)", "value": "4c1953018880625a88b7c75f720dbe9d9f4923497b252f1af1627fe862144c3131018660f16d429c0e1b6ac06de06ae0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947011, "uuid": "90b2089a-427d-485b-bfd9-d87bec85db85", "value": "0AF3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947011, "uuid": "b80207cd-d70b-4a98-ade6-063ac535ae57", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947011, "uuid": "804ad554-2efd-41f0-958d-b493af929a59", "value": "3072:cwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:cwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618947011, "uuid": "fe77c3b8-bf85-466a-bc3c-7775e467d012", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618947011, "uuid": "77533c1c-84e6-402d-bc48-5cf3ed899241", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947011, "uuid": "2c241bf6-7021-441f-85d5-e740f0a0c74e", "value": "628d41ca34fcbce679f292aa2ca5cbaf375c7de0005097238e803c1e60efa235", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716e6c6e-a1c7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618916353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916353, "uuid": "ea635d42-7313-4197-8d1b-b5c8fe0164d9", "comment": "Malware payload (Dridex)", "value": "8950490ea12cc79598e9386f13847fd7", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916353, "uuid": "47aca2ae-f7c2-4318-95d0-481e4046a536", "comment": "Malware payload (Dridex)", "value": "628f185abfc50a8839e682ff700248f0ffc9d95ae4aed4698aab7506ffe92f0f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916353, "uuid": "0f264c48-f621-4329-bb55-05e0be6dcdf6", "comment": "Malware payload (Dridex)", "value": "0a5d8d5d4f90158297d6a805a14a288a70047805", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618916353, "uuid": "1d044da5-79a0-4325-bc1b-2f5d72e5548f", "comment": "Malware payload (Dridex)", "value": "e98fd520bd5869760f83568350f068e2e66799455a03db8cbb80e0488d79ce303f48b36df4abaaf8ef1f970653d18aed", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916353, "uuid": "304e3116-ebb9-4bb9-9af0-9b45f1ff2564", "value": "CDF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916353, "uuid": "48eb18fc-dd2e-4b44-b628-4caf5b12a64d", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916353, "uuid": "5313d236-2d27-47fe-9da6-8d7182664ea0", "value": "3072:8lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:8lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618916353, "uuid": "61308ea7-7fe4-4887-9e77-2ca2002bb3a7", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618916353, "uuid": "f5633a81-d408-43d5-b6d1-4bc882e57cb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618916353, "uuid": "995fbf2c-22e3-4af7-be60-d8e5e98e06f1", "value": "628f185abfc50a8839e682ff700248f0ffc9d95ae4aed4698aab7506ffe92f0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b971a54-a19e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618898627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898627, "uuid": "741ea2d7-7a5a-4cb3-b274-7e26ee6962c4", "comment": "Malware payload (Formbook)", "value": "a4ca2541455b21d37f2248912523afb1", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898627, "uuid": "d39cbeab-ee3f-4877-bc41-43b1f2118f56", "comment": "Malware payload (Formbook)", "value": "631b6b713ce0d568c634c925e22a834fc2cd249dd1854ab0740ed841597e21e6", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898627, "uuid": "906616ab-99f8-454f-b4b9-1b2315bc112a", "comment": "Malware payload (Formbook)", "value": "daed7402403de3bf1c3f3570955131527f6fd520", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618898627, "uuid": "00461171-c21a-44a1-aa8f-7e74a6f9600d", "comment": "Malware payload (Formbook)", "value": "2f06fbb711140daca4a6662c5ab73e958e22c0e446e6299e77de0830c85c690f79dd0a91b6519ed807bf9df10fd1bc33", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898627, "uuid": "0a5d0959-5163-4816-b979-07b9d129cc57", "value": "9EE4235473ED6D4021DB752C29AEC41D499AE8B4AF197430E794EBC0CDBC2F89AED0E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898627, "uuid": "c9d5bb96-3254-4695-bee2-d4c9426cf544", "value": "12288:cyHXrEUCN+ChXmKzewDbTcFNeKzn+Xyqw75smecxSJZxGOm4XmBrmcsbw79D/fgc:cy3gL+CNmieewGK+wNecxSPsbomBrm7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618898627, "uuid": "7b2a914a-93c7-4333-832a-e5f53a10a1a8", "value": 702760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618898627, "uuid": "c56c0787-a6bf-43aa-b3e9-a03cd4ccc613", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618898627, "uuid": "11c6f6c1-edf1-4d49-8369-c62f433f22f5", "value": "RE New order.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ebe8164-a1d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618923087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618923087, "uuid": "77b45748-f594-45ba-9420-ea4004b81b07", "comment": "Malware payload (Dridex)", "value": "0741cbd1b8dfa2dc6196b39888f13b5b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618923087, "uuid": "3b0c19e7-061c-43ac-83d1-3350bdf77da5", "comment": "Malware payload (Dridex)", "value": "632da8472c3cc24696fc19671ebe12a394add9c856f5ce2c7907b7bf4d8845c1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618923087, "uuid": "2359e4c3-6693-444c-8ade-0ebd83af0271", "comment": "Malware payload (Dridex)", "value": "6490b0fd9948e860a05161e05c1703448249ae95", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618923087, "uuid": "d2286fee-21f4-45a5-95a1-2e379cb103ca", "comment": "Malware payload (Dridex)", "value": "380380005e95d53a37ec2b8e19cfc88d46409e123fb6b7be4ec5d1a946e051e4385db092bf6d1220e93074a8ceab865e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618923087, "uuid": "1e5a94ad-17d8-493f-bbc3-c798e3719c78", "value": "04F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618923087, "uuid": "34d11337-9890-4600-a097-5e27bb1ca511", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618923087, "uuid": "32f842cd-4025-4811-820a-0a0a67ac4f87", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618923087, "uuid": "28b61a07-eff1-48f5-a719-04d9e46b55ad", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618923087, "uuid": "528a4b87-7c23-49e8-a522-ffd4b4acf3d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618923087, "uuid": "c2d65bcf-7344-45c3-bbd7-39b8c65b13a3", "value": "632da8472c3cc24696fc19671ebe12a394add9c856f5ce2c7907b7bf4d8845c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3aac46f-a1ff-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618940489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940489, "uuid": "ba7f61ae-baab-45d8-8cac-f0016fb7e0a3", "comment": "Malware payload (Dridex)", "value": "050ac0e6cc499d6886d9f98d33e265aa", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940489, "uuid": "a6cb64a7-7c4d-4ea0-af5e-bffd1f677d98", "comment": "Malware payload (Dridex)", "value": "6337b98e9b811e07a1bc5d1302657e4ce13281b246359b1937ebb843bda891f3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940489, "uuid": "93832720-fbb7-4d73-936c-8069b44ac338", "comment": "Malware payload (Dridex)", "value": "84a315db8fcd7d28ab3a245d2fc6b888561aa546", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618940489, "uuid": "44942938-5649-434b-97bb-934e204d16c8", "comment": "Malware payload (Dridex)", "value": "a7ee2fea63f3e15eae579e7dae7139446eef210ffe733ebb626b29451f9f2a20c48cbbdfb2435213962ff7b9c73e1745", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940489, "uuid": "42a042f6-0dac-409c-813d-5904d958bdec", "value": "29F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940489, "uuid": "90b8ac2a-42e6-406f-afc3-67a8651bf15c", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940489, "uuid": "09bab1ae-b146-4336-b82a-2953ac59e4e3", "value": "3072:7wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:7wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618940489, "uuid": "6a984b52-e677-4d46-b924-00c4a106d684", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618940489, "uuid": "b88470d6-a61c-4e26-a8b6-e2b650afc092", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618940489, "uuid": "30a1d2ce-e49e-45b0-b63a-aa386ab61c18", "value": "6337b98e9b811e07a1bc5d1302657e4ce13281b246359b1937ebb843bda891f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a706610-a20e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618946809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946809, "uuid": "9841aecf-4c61-4be6-84bd-3f8e41ce12f8", "comment": "Malware payload (Dridex)", "value": "aadfd4211c09c45ed9834dbf8eefe217", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946809, "uuid": "a86c39ba-52bc-4cbd-b068-0ccbe005533e", "comment": "Malware payload (Dridex)", "value": "633d0ba6ca5ef80bfb76924d0d1894c3cdee93492ad7523f1e11bb6f998a5c27", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946809, "uuid": "0a89eec6-c61e-4aef-9dec-78087e6d4760", "comment": "Malware payload (Dridex)", "value": "3023a0de7859e0147e23519adf4712d5ffd02211", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618946809, "uuid": "39b7e1dd-e65c-4694-a001-b0b4e84d3da0", "comment": "Malware payload (Dridex)", "value": "d4698ae7307611e12720ff6045e72887da7bcf2343c23df1e48d615cb7ade3867a6ae02863a7a801f933bfd9b6d75563", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946809, "uuid": "b09e93a9-005d-4473-abb7-a6ba2c236638", "value": "F1F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946809, "uuid": "3eaa8836-5285-48b1-9733-10781452c8c3", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946809, "uuid": "867a0d8e-9643-4d7e-9afc-7bc2c50ac95e", "value": "3072:kwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:kwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618946809, "uuid": "9d6e2f72-818a-4b03-bb19-57571cc02eb8", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618946809, "uuid": "3e4133b5-90c5-4749-bce4-745631aa0c6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618946809, "uuid": "62ec160b-056c-43d9-88c0-f2a0bb80c785", "value": "633d0ba6ca5ef80bfb76924d0d1894c3cdee93492ad7523f1e11bb6f998a5c27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb252ee-a230-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618961335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961335, "uuid": "049fd690-bac2-4a3a-9949-823596335ddc", "comment": "Malware payload", "value": "198544bbb4962d1438ed22cec5780fa3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961335, "uuid": "e445c305-6d04-4123-a45d-69c4b9522f7d", "comment": "Malware payload", "value": "634b3763f4a86107e8af2b84f9f89473f474d8187bf127602f82b74407f1c289", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961335, "uuid": "5d38bdfe-e8ad-4559-b14b-658d9fdc65cd", "comment": "Malware payload", "value": "85e638666cab24c8437b0a0984eef6e78067a24c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961335, "uuid": "168d50b9-2712-4b2a-856c-03a0b68f117a", "comment": "Malware payload", "value": "3340a9258edd2ff3bc0391676e929bd53a291790c59311c944ef1b7437460bb7a0becc7704dd39b2e1ba371b58e705d5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961335, "uuid": "fafb5d5b-8db4-4d7c-95b2-bdd889a21ef4", "value": "64F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961335, "uuid": "12009176-1157-4e2a-bd3c-7c2c2c12c4f9", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961335, "uuid": "f13b83a2-b28b-47f3-8bab-35875e417ec5", "value": "3072:IwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:IwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618961335, "uuid": "794ca97b-51ee-4afa-952c-4813657b9bb0", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618961335, "uuid": "f80e9448-82b7-45d6-aa77-3e44735bcdb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961335, "uuid": "226bc166-d772-4282-94bd-7504add2b1d7", "value": "634b3763f4a86107e8af2b84f9f89473f474d8187bf127602f82b74407f1c289", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eccb0ad7-a19a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618897233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897233, "uuid": "c4c24bb9-8262-43c4-9484-a84f8ab4bbe0", "comment": "Malware payload (Dridex)", "value": "79dec4a04d76cac651ae701b9850d2ac", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897233, "uuid": "64eb2788-e73c-4bd8-9dd2-af8c56082f92", "comment": "Malware payload (Dridex)", "value": "635f6e52f381f1274fb96159d8aa6533cda28944f173b991853fef9c656fb848", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897233, "uuid": "f82839fc-f60e-4599-a6a7-34df49eaf2c3", "comment": "Malware payload (Dridex)", "value": "15d2ce2720eee6178481402166b3967565f4e948", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618897233, "uuid": "c36028c3-b1e0-476a-8c98-214fc55f0c35", "comment": "Malware payload (Dridex)", "value": "23bfa68a4e0388b1086500bd336489455ba7ba9cb5c3ef23c9602a42c233ad704e2c7809ed8f055ad6b5eb54983d5940", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897233, "uuid": "32595ceb-43cb-4cab-b9d5-f0da57593d59", "value": "3EF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897233, "uuid": "c3e7010e-fc35-413c-8a28-9afb7e42686b", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897233, "uuid": "e4ce8135-ce69-47e2-b62c-fb6cd89b2e95", "value": "3072:Wlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Wlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618897233, "uuid": "fb92b1be-dbcf-4a98-868e-e26f47f53893", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618897233, "uuid": "62c0aeb0-12dc-45cf-81de-f51d449b10d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618897233, "uuid": "77cf9cb8-8a72-4a59-bd73-4a1fca67725a", "value": "635f6e52f381f1274fb96159d8aa6533cda28944f173b991853fef9c656fb848", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb700351-a210-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618947938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947938, "uuid": "6aaa6ac1-41c2-47a8-856e-fdf0582f8bf4", "comment": "Malware payload (Dridex)", "value": "baa09365809ecb2a2658624048e10ea5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947938, "uuid": "da1f4db0-56cc-4f7e-84db-5b4222f95bc3", "comment": "Malware payload (Dridex)", "value": "637a8d1cf5ae81d5482d030be74eb68398fe0d6e87aef937c7f68eed48458c88", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947938, "uuid": "9d603c02-e021-4905-85ea-c41d091f3808", "comment": "Malware payload (Dridex)", "value": "37d2cc9b61d34f9d7b9a18dc998d3d045bbae7a8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618947938, "uuid": "64a46078-ec2a-420f-81d6-5f3c8854c653", "comment": "Malware payload (Dridex)", "value": "24fdff7f33112f6d9d6d0b86329e43cb42e2aabc2f65a1c828447c19debed9e878d1e8c2e5a6001d07bebfff82a30e25", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947938, "uuid": "0ec6bccd-7526-4ba7-9bb0-8f14b0c6b2e5", "value": "44F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947938, "uuid": "36c05b01-cf9d-448c-b53f-3082c4754c28", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947938, "uuid": "7ac50d2d-16c4-4c87-823a-ef97e362ea34", "value": "3072:XwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:XwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618947938, "uuid": "4318818c-84fd-4665-8fc0-95cc34764500", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618947938, "uuid": "d13e05a9-dd6f-4895-bbd2-f2e0326f5035", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618947938, "uuid": "36dd1f17-1b7b-417c-9db9-c0a2f47b030d", "value": "637a8d1cf5ae81d5482d030be74eb68398fe0d6e87aef937c7f68eed48458c88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c50217fe-a1a0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618899743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618899743, "uuid": "3f9afff2-4781-4d59-9995-a46222e3e7e7", "comment": "Malware payload", "value": "0df5ce66cfe3eab5bdafdee5ac9d29c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618899743, "uuid": "efed3cdf-b46f-43c8-be8b-cb22c56da113", "comment": "Malware payload", "value": "63864f4101662c420bf5c420b0b0e8094d8d5da10581394a5ffe14d7f905df06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618899743, "uuid": "16dc2c58-49de-48f3-a26e-3479ffc33d4e", "comment": "Malware payload", "value": "dadfef3eb80db5a60001864a68dc5e9d83827af7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618899743, "uuid": "051f9d5c-e64c-4e78-b2d9-9a0ab2d6571a", "comment": "Malware payload", "value": "d2f6e63ac44527663084167936516742aed5b92c5e81e19494e2e22c38fd71dff5290eb5789855f1e5ba8f929a5f08fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618899743, "uuid": "268454e4-1443-4588-976f-94a2da523205", "value": "DFE423931B53BE2087EF13F9EF112D9A3DAD00E190B35F26C34A506917678E1B2659F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618899743, "uuid": "d5b47a69-b35b-4aea-8461-fb7a30af8366", "value": "12288:jNn+d1+U145uM4r3ZuF3p1rMDH7LAK11k/Pip3D6HDWO9j9BGI9U2f:Z+iU25uM13DrsH79kk38xU2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618899743, "uuid": "32f095e9-d312-4548-9501-239e320e0fae", "value": 694889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618899743, "uuid": "5f03c86a-0dae-487c-a24c-1751e4f85007", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618899743, "uuid": "3eefb303-8d21-45de-b37c-9fe450d345e4", "value": "Quot_675421-07.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e3da4e-a214-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618949649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949649, "uuid": "8ae6d5e2-168f-48b3-9aa9-329cb5e14c55", "comment": "Malware payload", "value": "59b5f45b4d0b2ccfea5bb2bd1ebc4ba4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949649, "uuid": "0f29cf4f-0f05-4a2d-8319-b749d49b4597", "comment": "Malware payload", "value": "63873589029ec09e3e73ffa581968026bf38ad446f593d6c85ec853f9982499f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949649, "uuid": "c83db931-d850-49d8-9a00-112b4db82c65", "comment": "Malware payload", "value": "68e27368076effff3d817360dc64867510ffe20f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949649, "uuid": "5bf39796-ce5a-4bc4-b03b-541c7c63ae3c", "comment": "Malware payload", "value": "260f22d59f9685875990837b79eda59942e951c2b5594a62964f36bb357c42da2961d188cc67e16826d2d68395e821bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949649, "uuid": "00b99018-e7ba-4453-8b62-8e4e6d8241d1", "value": "F0C2E19E52EC2F63C288DBB9503ED26558185BFCFF0A8612FA5E2E1835F841118A2975", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949649, "uuid": "2d43a429-bd57-4cf5-b5f8-dc32a857ad81", "value": "768:nsLqKo91CVzb9zhraMQgerEA3rEsm315hfgPQ/7nmmR:nsdM1SpFr3WxPuDIoTmmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618949649, "uuid": "54a17aca-953d-420c-9733-ef63a6b7ba98", "value": 27428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618949649, "uuid": "75c18ff8-d185-48f5-b7af-10db6f7d28b4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949649, "uuid": "330126a0-6ec2-495f-b4ec-4d0529e3ab9f", "value": "kool", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77fb188d-a207-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618943852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943852, "uuid": "94a00109-7d09-4b3e-9df2-3f206d0e2271", "comment": "Malware payload (Dridex)", "value": "84e10410bdea7e17bdb4652c5e4d0a09", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943852, "uuid": "b762c8e1-37de-4ff4-ae27-679894493f44", "comment": "Malware payload (Dridex)", "value": "63b24d41b74dae2c3497e79108f5dc1ecbd03c05957b742d1914fdd5c2df5549", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943852, "uuid": "55211add-ad07-4bd1-948e-653329a6064f", "comment": "Malware payload (Dridex)", "value": "a92a37371ca4f7d9e50631de7ab55c2664b124d0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618943852, "uuid": "7c2ffe47-cd9a-4715-a163-35e3273c9c72", "comment": "Malware payload (Dridex)", "value": "3efd7c73028c6470532d8ef6ebc8531578f70c515597bb160a75450357d2675bfa42c52984f410c38817c0ed2bc6e666", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943852, "uuid": "fbe8dc81-ee51-46ac-a089-ffbf002412ab", "value": "C7F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943852, "uuid": "8cc156a9-4427-47d4-bdbc-6d714a82cc07", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943852, "uuid": "a01bf552-9acb-49cb-a639-2cf8b439d47f", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618943852, "uuid": "357869f8-3a43-4ab8-8682-505bf52945b0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618943852, "uuid": "4420649d-9928-46e1-bf8b-30c9c04d8b05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618943852, "uuid": "fbc4eaf6-3f26-4455-8bda-ad38ab62111c", "value": "63b24d41b74dae2c3497e79108f5dc1ecbd03c05957b742d1914fdd5c2df5549", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0011aa7f-a230-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618961260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961260, "uuid": "f3639e98-d061-4edd-beec-a6ee15dd6833", "comment": "Malware payload", "value": "0fc2cbe1968561bca5a4e98a19a83a83", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961260, "uuid": "25caba3c-8b05-4e91-bdc9-3a6c2e79c60f", "comment": "Malware payload", "value": "63bf5989397a25b62e71a8df46fe5849b562ca52bf02351d9d2e1d24b3feae0d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961260, "uuid": "666868af-4300-4773-acba-95c82e1bb15c", "comment": "Malware payload", "value": "c813aa60c3a68a53c9c937a330b65984c9cee487", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618961260, "uuid": "245c355e-86d5-4aa3-a33f-625acdf91477", "comment": "Malware payload", "value": "fc53debc2e39ae99d270284da1c88ae88040495fd2a50c73378a9c40225598696352f051055794732acf2f9ec360d2b7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961260, "uuid": "5fcef3e0-097a-4e7c-be24-de8759b76315", "value": "59F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961260, "uuid": "6f7dba97-29d8-4f4c-b2ca-68e253f75804", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961260, "uuid": "64c7926d-78aa-4e47-b965-633a701193f4", "value": "3072:9wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:9wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618961260, "uuid": "47fead01-67f3-46a3-850c-d9024bfc342f", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618961260, "uuid": "5aa75cb9-dfa1-420b-91c9-ec2241b908c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618961260, "uuid": "74f6c0a3-f974-44c7-a90e-f2ffc8456f4c", "value": "63bf5989397a25b62e71a8df46fe5849b562ca52bf02351d9d2e1d24b3feae0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1109a0c9-a216-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618950122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950122, "uuid": "7372c65f-55b3-474b-91ec-502a1974babf", "comment": "Malware payload (Dridex)", "value": "d8755b531e6e15a0b56e20832924a2bc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950122, "uuid": "9e0c9306-5e56-4cb9-bef8-eeb9d076eb55", "comment": "Malware payload (Dridex)", "value": "63c46fefedc1267484500bc510573faec05db469285ba9e7fc8685364f0bdb7f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950122, "uuid": "fa1955dd-7edc-474e-8783-49fdcf587697", "comment": "Malware payload (Dridex)", "value": "a3c47659f127e1556a03f318421c49c7b892e380", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618950122, "uuid": "935ba929-82fb-46fc-a072-f4e249481c34", "comment": "Malware payload (Dridex)", "value": "74f78ed8426b369a248116fe564b6d87de43598e323c047c95520a403f37ca3afd77147d7865a07ff6684d16cfbbc484", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950122, "uuid": "4085e395-91ea-4f9b-ba6d-836a87b80cab", "value": "57F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950122, "uuid": "0a4db9b6-cb7d-46ed-8b9a-9392a190868e", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950122, "uuid": "6c8eb4dd-fba7-41f5-9d51-43eeea326875", "value": "3072:ewZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:ewZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618950122, "uuid": "f351ebd0-f581-4a38-8e8d-f83ad1459857", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618950122, "uuid": "ce80d5e3-6aef-4902-b309-19c2c27eca1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618950122, "uuid": "1161265f-c7e7-470a-89a1-bc83fb9227ae", "value": "63c46fefedc1267484500bc510573faec05db469285ba9e7fc8685364f0bdb7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "113ca078-a205-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618942821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942821, "uuid": "3ef1871d-c2af-4885-ba19-28a3b64fbf8a", "comment": "Malware payload (Dridex)", "value": "391924746837ba2117ff92fd264a697f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942821, "uuid": "4e975475-b0ef-4427-9104-010beac22f52", "comment": "Malware payload (Dridex)", "value": "63d6a081d41d6e0cba3ee8455b175c2dfe7d7b2625a3f2129281f4cb46332577", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942821, "uuid": "4d674078-4231-499c-b01f-5c4dcd6b2e16", "comment": "Malware payload (Dridex)", "value": "8c12889ef5d4fed49eeb2950eaaee23481438cb2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942821, "uuid": "b2385760-3752-43ee-8941-d607fe730e2c", "comment": "Malware payload (Dridex)", "value": "f1ecdd0e9d044a0454100ba462d10e1a75a8b53f9bd731e7051af98c078ed5bae457fec135ed96f1f71b5a4d081c961a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942821, "uuid": "27787218-9ab9-4cf8-b5c0-cec42d026e8b", "value": "1FF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942821, "uuid": "dde64c6c-764f-46bb-98fd-f4d0d4edc5ef", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942821, "uuid": "1654ade8-911f-43b3-abd8-185420f10391", "value": "3072:dwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:dwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618942821, "uuid": "274878c2-4174-4a30-b95e-05ec3fb56c84", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618942821, "uuid": "2ed4d47b-4324-44fb-ba25-2e4ebc021943", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942821, "uuid": "be576559-5f5f-4003-8732-49b65f3d89bf", "value": "63d6a081d41d6e0cba3ee8455b175c2dfe7d7b2625a3f2129281f4cb46332577", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b771c9b9-a16c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618877387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877387, "uuid": "0a89449a-9066-482c-8e4f-d12705f1f6c0", "comment": "Malware payload (Dridex)", "value": "153ec8b10e432cb54ee85335ee943a78", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877387, "uuid": "0b5f9008-f8d6-49f4-99fb-0f9b176c5284", "comment": "Malware payload (Dridex)", "value": "6412da250e6a04aba1cbbe3a6fd4676f50568361169c711b6d8878ce4f42586a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877387, "uuid": "8b4e5490-fc05-4e06-99b3-1985981edc29", "comment": "Malware payload (Dridex)", "value": "e79187e150eb6202721b5e169afa9bfdc203aadb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618877387, "uuid": "415ff564-b273-4d6d-ad3f-9b49bbfccfc8", "comment": "Malware payload (Dridex)", "value": "6651160523d865eeb474dbad761f0a24489e76707a8ec5f5c4da365716d5cd33773ad403f80784477be85665976f97cb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877387, "uuid": "5e15017e-4b4d-433c-8723-d1a14b29e236", "value": "18F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877387, "uuid": "eb40f245-9f42-4965-a9b0-a71e144befe4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877387, "uuid": "ac5a6c4b-c858-46d1-8d3d-9f9f6e68a10c", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618877387, "uuid": "28f38a4c-448b-4a7e-adfc-4a30703e2312", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618877387, "uuid": "d770c093-c7ca-4ab0-8461-5d992648d819", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618877387, "uuid": "2c699d36-5e93-4626-9a54-0f4af280bd28", "value": "6412da250e6a04aba1cbbe3a6fd4676f50568361169c711b6d8878ce4f42586a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4d4c19-a209-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618944936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944936, "uuid": "44eccbbc-72d8-4d50-b00c-7dcc6e1b94cb", "comment": "Malware payload (Dridex)", "value": "39bf70866698a4b5847d1ac33ae5bfc5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944936, "uuid": "5daeaa63-5675-4ad5-b8e8-c2cfcdad0f39", "comment": "Malware payload (Dridex)", "value": "643ebe210d0720a5c878e1cf35297f558b07a8f6d49cd6bf4a0db1249bdf1d01", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944936, "uuid": "77f4e623-e67c-45f9-95ad-707b29f866e8", "comment": "Malware payload (Dridex)", "value": "0129313628148d687489f2d8f928402bd32c0d51", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618944936, "uuid": "4624ee20-abcf-4ea0-8307-c4f01b05c2a8", "comment": "Malware payload (Dridex)", "value": "3fbb9916e62183c5f037f15b416a7f68e24fdc549b3b5dbd20860c52d3a00f4af90c7eba80a1162863995e039021443f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944936, "uuid": "195c6cdf-d443-4cbd-81e6-977f1585beaf", "value": "45F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944936, "uuid": "4dc0320d-eb6a-4c8a-b0be-f0da81bb58b4", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944936, "uuid": "a44ecc84-7780-4665-8362-fe139155ced3", "value": "3072:pwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:pwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618944936, "uuid": "8e3620fb-72a5-4af7-bafd-27de938a2456", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618944936, "uuid": "364443a1-4ce6-48cf-820f-582ed6d30d34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618944936, "uuid": "4a0deeda-58cd-45d2-b42e-a86b07bcca9f", "value": "643ebe210d0720a5c878e1cf35297f558b07a8f6d49cd6bf4a0db1249bdf1d01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76484724-a219-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618951580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951580, "uuid": "97f4c91d-6a6b-41e7-b46a-a0ae32e9ec28", "comment": "Malware payload (Dridex)", "value": "049b786cb7e3a509cf1e39a9132dcc45", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951580, "uuid": "5a0e3d0c-d87b-42f0-97c2-36e53c3db05e", "comment": "Malware payload (Dridex)", "value": "64542da2790dca53cdcca0e8f407d42a0d283a35892bea1270684790cee1d185", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951580, "uuid": "80b15d64-17c8-4710-b67d-13489be8873a", "comment": "Malware payload (Dridex)", "value": "86e504f3124b728c78e94d10971ac296282e4215", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618951580, "uuid": "65a1416a-3279-4254-ac8f-6f169d8cdbf5", "comment": "Malware payload (Dridex)", "value": "39d9dab2d3d84ca838afd2a12f1d08534ac5656191ae8e30a982b73cfdcda5e5f5c53a249a91a4bf77cdf6dcd84057b7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951580, "uuid": "4f6ec79a-a104-4287-b7ad-4ea9455dacfc", "value": "09F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951580, "uuid": "676788c5-adf2-4c3f-b094-706917fa3e94", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951580, "uuid": "ec6232de-af2a-4318-8fad-12d6c703a836", "value": "3072:rwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:rwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618951580, "uuid": "b2c3e95f-1cd7-4394-895a-076ff2a05fac", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618951580, "uuid": "57e84686-afef-4d4b-807a-f1fe993f22a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618951580, "uuid": "6c775c34-2579-4517-8b15-2115481d4745", "value": "64542da2790dca53cdcca0e8f407d42a0d283a35892bea1270684790cee1d185", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecfad714-a1ea-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618931593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618931593, "uuid": "6bd0ef4b-3a09-4ce5-8f48-0c40ceecdedc", "comment": "Malware payload (Dridex)", "value": "1455577ccaab82acb13bbf88a01e8ef7", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618931593, "uuid": "4ae08462-9741-4db5-be4f-3e41830f9d58", "comment": "Malware payload (Dridex)", "value": "645fc1083a004d15676afc59bbb9719cae0a53ba847ceaab1c47dcd6b7df6082", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618931593, "uuid": "1d53abf1-a37c-40a0-931c-c187f262ccb3", "comment": "Malware payload (Dridex)", "value": "cdab4ab50621c70e45e13f1d5597c1fce7e4344a", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618931593, "uuid": "5afadd3f-757a-4d88-98a7-26558b8271ee", "comment": "Malware payload (Dridex)", "value": "a7c1498b688ec8409c0c1901fdf262a46356bb0bda32113b4c6835911d98f58774bc1ff58f71f75f3c878a6bd3b69c0d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618931593, "uuid": "5dc6f46f-c9d5-450e-9b8c-2f4c68464bbc", "value": "41F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618931593, "uuid": "dea1c978-9787-4430-83f8-ff4d899c78cd", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618931593, "uuid": "6d68e174-0b8b-45ec-8816-4125d743e0c9", "value": "3072:eWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:e42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618931593, "uuid": "98711d14-0a02-4cf4-9333-5eb9e1b36ae8", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618931593, "uuid": "be942e74-5081-4b78-b446-1053b987a7e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618931593, "uuid": "b636af47-c9d1-4eea-abf5-3b8130a0e3a6", "value": "645fc1083a004d15676afc59bbb9719cae0a53ba847ceaab1c47dcd6b7df6082", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d183a95-a20a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618945203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945203, "uuid": "dfdae469-e22c-4edc-8a1c-ff79485eb0b5", "comment": "Malware payload (Dridex)", "value": "8ae826fd6c0247e30e0983db93e61d90", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945203, "uuid": "56131bb4-c7cd-43fa-9d09-0b1f07f3e5b0", "comment": "Malware payload (Dridex)", "value": "64b1f42c965d05ba13ab12ef413c9ca2e0573fc45f9935c96db9015fbdbe7aae", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945203, "uuid": "16884805-b6a6-4fa8-bfa7-33da9bedf0ff", "comment": "Malware payload (Dridex)", "value": "4782a7fcf942d6de5c153941f4e68958a6181959", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618945203, "uuid": "01f41489-77c4-4ce3-8f7c-9e6a929a2e24", "comment": "Malware payload (Dridex)", "value": "5f73942964741f09ad996af1ff8f57767791e49ea95febfd992f21d4df784affea5a3664d6da823bad52a6eb30907d3a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945203, "uuid": "17d8c58e-1ee5-4efb-ab1c-e4e8310d8172", "value": "00F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945203, "uuid": "202bc1c9-74e1-4db5-976f-2948b5a129ef", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945203, "uuid": "868c4f29-02b3-4220-a5b7-ff26d129adf5", "value": "3072:3wZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:3wZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618945203, "uuid": "ab4f6a17-139e-4c0b-9622-5ca769b3ba33", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618945203, "uuid": "a9d36b9d-f265-4d11-80cb-ffed23f21777", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618945203, "uuid": "1013a933-2a03-4f45-8ce6-79d5f52dd058", "value": "64b1f42c965d05ba13ab12ef413c9ca2e0573fc45f9935c96db9015fbdbe7aae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9196428-a214-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618949625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949625, "uuid": "cc0b23b6-d761-4809-a0e8-6d55522c92e5", "comment": "Malware payload (Dridex)", "value": "b57c3ac11b3c06379d284a1d79437c47", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949625, "uuid": "32ae2034-05c3-42d2-ab3f-6b37d60aead6", "comment": "Malware payload (Dridex)", "value": "64c7e0c91ccbaa806fe70d22afdd0bd5d278a03fad5bc69998aca500e6b3d219", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949625, "uuid": "f1e3c27f-d827-4257-81e1-ff68d2775377", "comment": "Malware payload (Dridex)", "value": "489a4d67426cf6bdf8216358d31a4cb36a0241d5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618949625, "uuid": "f97f8279-db77-4580-a660-49c85714be6c", "comment": "Malware payload (Dridex)", "value": "1e7b4117d7dd820782e3930f4ddebb13cc2df6783f1ab1c80a22169140f700a86a0648d7ef99a8018673cd680fdd8f88", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949625, "uuid": "c8213734-f687-4603-b9ff-9c4f7e6fd10c", "value": "6BF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949625, "uuid": "b2a99742-aadc-479a-9ef4-85d88bc97ce8", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949625, "uuid": "382ea5d0-ae39-457d-8422-7f2d846daf1c", "value": "3072:vwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:vwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618949625, "uuid": "dde3ec10-386a-43ef-a55d-1431354e0978", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618949625, "uuid": "c65e1435-f126-4652-8f22-80bf5fbea865", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618949625, "uuid": "4e853c79-bdf3-4a53-aba3-e8d35a368c9f", "value": "64c7e0c91ccbaa806fe70d22afdd0bd5d278a03fad5bc69998aca500e6b3d219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2995835c-a1e6-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618929547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929547, "uuid": "1e16d3cc-ab44-40d9-b6ad-d5ef1f9dd687", "comment": "Malware payload (AgentTesla)", "value": "9b5d6b80176fb76c5632c21466173283", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929547, "uuid": "9b3fd914-8ce9-4cbd-94cf-da1c97c98cc5", "comment": "Malware payload (AgentTesla)", "value": "64cd8fc117b0c00735d0f1500a16b5e1bc29d1c008eddbd0fbb1b87baf8081b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929547, "uuid": "c9a7b19e-b87a-409f-8fde-f274ffc39cab", "comment": "Malware payload (AgentTesla)", "value": "fba13cbef0ee13edb1c81a250bc8a213894989c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618929547, "uuid": "6672e90e-7c3b-4af7-b6dd-eb57835370bb", "comment": "Malware payload (AgentTesla)", "value": "961ba9e8fd7bd63eaf0804c67afe93efaf1008b6f2546b6d281c67171abacf1239b2b8a4ce7bf418617c8579653abfce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929547, "uuid": "6dafcd06-b735-40f8-a162-9661aa428da1", "value": "C9D4012133989714EC7F9FB41821564113F7B216FA25EB1E7D98206D9EAB602C7227E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929547, "uuid": "7f663d24-4890-407c-b7fe-9863ba5d9245", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929547, "uuid": "ad59af4f-acbd-40bf-ba1f-9bc187d45fac", "value": "12288:/2lphgBY2NOO0h4VO36IG18cOsLhk1gCgMQAGjF2S8gmTjmOVzRRRRRj:IQYYOO0mQG197FuBQAGR2xTjmOpRRRRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618929547, "uuid": "67bb519f-693f-45f0-bb68-e43a3f21137d", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618929547, "uuid": "4cb0764f-517b-44b1-a0ed-8f76d3ecc86f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618929547, "uuid": "bd152efe-6cb9-4bbd-b682-19d023a40737", "value": "GS_ PO NO.1862021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f326d2ba-a203-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618942341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942341, "uuid": "131848b4-c03a-4f01-b9f1-92a0f174f4c0", "comment": "Malware payload (Dridex)", "value": "dbbc4428b52c6e476e651d39c9d5f228", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942341, "uuid": "08415b46-ef8a-4a03-aed3-b1e62ffe9f28", "comment": "Malware payload (Dridex)", "value": "64cf0a68b7623971b45c2564901de9b0ec58ef6eb63750fdf858ffe246839dd0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942341, "uuid": "d3c4b9dc-b00d-49a2-ace9-9f3cd125cdb9", "comment": "Malware payload (Dridex)", "value": "529208b6c3074d436afadb01cb469fd718ca2f76", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942341, "uuid": "cf3fe18b-431f-4458-8b26-02ea57954a58", "comment": "Malware payload (Dridex)", "value": "c91797bedea6aa3e9e7191f65982f214eb5fc120c8f0531c24c2dace66fa23f2d77d0014323cd3921628454f34edecf4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942341, "uuid": "b5d9779f-e229-484b-a1f1-3b2fd68413f3", "value": "B5F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942341, "uuid": "3b02b27f-08a0-4d3d-bdd4-c3686470e817", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942341, "uuid": "b810fecd-fba4-4c51-9ae2-09d1bd7cf147", "value": "3072:GwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:GwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618942341, "uuid": "7585974f-95be-4a20-9563-6eba3b78c1c1", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618942341, "uuid": "0bc22bea-fe62-40d1-9fe9-a92e737bfda7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942341, "uuid": "ed6d69a0-588c-4fa0-8545-7b75cb0b4d06", "value": "64cf0a68b7623971b45c2564901de9b0ec58ef6eb63750fdf858ffe246839dd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2083997-a1ce-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1618919549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919549, "uuid": "0972a3e9-2886-4117-8893-bb4e3516ee00", "comment": "Malware payload (RedLineStealer)", "value": "5cd7e72960710390d2568d608066a599", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919549, "uuid": "c1f9fdc9-4c89-4003-959d-fe61917bde6a", "comment": "Malware payload (RedLineStealer)", "value": "64d2f9f6fab520c3de6f37e7c6f3d77cacc2988d0df3f107536cf0eff8a12862", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919549, "uuid": "1992c541-3ee6-4247-837a-f207625d08b5", "comment": "Malware payload (RedLineStealer)", "value": "4204422aed9e9bccc7d79b7a4352f5e2c32e8a67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618919549, "uuid": "ff0ad22d-0f5e-4c56-b9b7-df0eac5ad64e", "comment": "Malware payload (RedLineStealer)", "value": "9c64c69898be794f083c9c8e6c54ef3fb72d0bd5d3e14d3cbde2241e0eaed36e37f69c9d85d73f10e1bc616df1c1bc80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919549, "uuid": "9244f196-7477-42df-8279-9d498d5d175e", "value": "8AE4011173D0C03BC19226B58519CBF14FBE7470696A9A8FBBE80EF85F246D1972634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919549, "uuid": "7c1718f0-66a9-4c1b-9531-fb91bf09bd73", "value": "e8f471970702c14a5804527d11021519", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919549, "uuid": "e1c55f75-4fb9-48b8-bd21-c7abf7376f05", "value": "12288:/C5jmKR9nN4OmHiUWXZXZq15AccP9NhS8K7FuBH/iN0KJu6jw+:/yRhNS2XZpKfcP9NBK7AH00KJuUw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618919549, "uuid": "2ac344d8-fe76-4d16-81f4-a520ed3a8936", "value": 670208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618919549, "uuid": "797ca166-7a4c-47bc-8e86-5b32f7ef61f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618919549, "uuid": "f8370aaa-17bd-454f-b719-559f414e6f53", "value": "5cd7e72960710390d2568d608066a599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1d558f-a171-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618879466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618879466, "uuid": "9e72d55c-b236-4458-9879-6f04b1d7e3e8", "comment": "Malware payload (Dridex)", "value": "f94cdc1dee36d105334e0680bc573e70", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618879466, "uuid": "c814aad0-5333-43c6-b068-651cb130a94d", "comment": "Malware payload (Dridex)", "value": "650d3100107928a37dba31d5abac47dd70014e340120043f3baed3a41bd702ef", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618879466, "uuid": "0793b1ba-bab5-42a5-825e-68cfbbc107fb", "comment": "Malware payload (Dridex)", "value": "669bc87a394ef58699933b0b19d4329c403a6a10", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618879466, "uuid": "f0c3fdd3-ba05-4f2e-84bd-b2b8f6436f53", "comment": "Malware payload (Dridex)", "value": "07f2c1714677df5d32972ca689ec702919c45e8c15904f95d1bf5f7500cdcbccc13cbf2580f378a81f5301b0084fe7ac", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618879466, "uuid": "44b22335-70da-4d10-b255-aae170adf0cc", "value": "FCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618879466, "uuid": "09b1fc28-2cd1-4f96-9421-80818a512eab", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618879466, "uuid": "f738b432-69bb-42e6-81e0-e543064fce84", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618879466, "uuid": "b789bafd-d1ec-44ae-9a94-228281cf6ede", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618879466, "uuid": "6c1cdc41-a9a4-42b7-a67c-91b6f13faa37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618879466, "uuid": "e7adf5df-97d2-43d2-810a-a3dc5750a65d", "value": "650d3100107928a37dba31d5abac47dd70014e340120043f3baed3a41bd702ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c06de62-a204-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618942409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942409, "uuid": "cc7f8c03-62f3-4d6e-94e8-e5f49612c8e4", "comment": "Malware payload (Dridex)", "value": "09b0a11492fa803f5936a9139d6529ab", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942409, "uuid": "e97f11f0-35c8-4c80-83e2-0639034bf727", "comment": "Malware payload (Dridex)", "value": "654ba7ee3d20deaf0f7b66071ec829ff9b12c76fb41fa7511e7e4a01d7c8ae4b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942409, "uuid": "958ee7c1-6e71-42bd-b20a-93fcce13bef9", "comment": "Malware payload (Dridex)", "value": "16b7ee36e4d378d950668cb2c538232a91408b2f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618942409, "uuid": "aa1b2c8c-b1ad-4d15-a34a-f7b457953a13", "comment": "Malware payload (Dridex)", "value": "0d06a951a7c3000d9cbf19b3d0dd86af6aba5348a2ba66841387701d7781a73a84fced66c411f9d269b82f8b8c4d4db3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942409, "uuid": "61d321eb-30db-4ff7-a275-62c19f55f49d", "value": "9DF3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942409, "uuid": "46da05a3-31d0-4f38-97b5-f9f104e9047d", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942409, "uuid": "cc419f59-57e3-4549-b205-37956e7eb898", "value": "3072:DwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:DwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618942409, "uuid": "bf16d4bd-00e9-488f-a2fe-c96b1c9aef54", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618942409, "uuid": "890875b1-baa7-4274-85bd-02ab24881174", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618942409, "uuid": "ccb558f2-4421-486e-a69c-b5afec4a9af6", "value": "654ba7ee3d20deaf0f7b66071ec829ff9b12c76fb41fa7511e7e4a01d7c8ae4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef9e70d-a1d5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618922362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618922362, "uuid": "b85daa35-d041-4f62-88ad-78aed659ef3d", "comment": "Malware payload (AgentTesla)", "value": "0ff6e91955bbb301f410002f3905043c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618922362, "uuid": "6a543fa7-f646-4cad-8a4a-37bbc2568fdb", "comment": "Malware payload (AgentTesla)", "value": "654dbb631614a97dbd54ac0cc8f7497e25175407c7350510700caab2cc1723be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618922362, "uuid": "4b68e076-bb21-467e-a09b-8ab9a1cf365b", "comment": "Malware payload (AgentTesla)", "value": "a1efa89cc5cf25a77e3856f5226305fc124511be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618922362, "uuid": "9c993543-1c85-4eb0-85d7-4672477da826", "comment": "Malware payload (AgentTesla)", "value": "8461e71d2bbee40a736de5e073d0481013a0ee3207d25afc2b38b3c43e39e3f9368aa33221b473be51983e6715007c97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618922362, "uuid": "82b4f5ea-d8c7-487c-9285-3364d14652cd", "value": "C6F402229B8CF7DBC92C0BB1E45199765A730247E758CA4FE85D40CC4AE5782F86C3E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618922362, "uuid": "44285943-bab9-4497-a4eb-fc0f24a7f6c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618922362, "uuid": "6131eb7d-c955-4f46-a193-175489e0a126", "value": "12288:9hlc+QVYVnNVMJbk56sVFEhphJ7mKwMdsyAtFEu7kGmff61J10MTteeHZM:xc+EYVN+bk56phPJCKwqW3Eu4pKH109v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618922362, "uuid": "18f95cb5-f539-406b-8f0e-a3e955a9de3d", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618922362, "uuid": "1acaea1e-53c6-4f9a-ba9d-57103b706db1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618922362, "uuid": "e7aabab2-6065-485f-8013-5a5a6754980c", "value": "PP-19042021-928_00902.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7feb9c1-a223-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618955985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955985, "uuid": "60f49368-27b1-431a-9829-97c855dcb3c4", "comment": "Malware payload (Dridex)", "value": "a960fbe94296f603a8cb388332674de4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955985, "uuid": "a01480c3-fd80-4815-939d-fa340fb9f5d0", "comment": "Malware payload (Dridex)", "value": "656cef7c18ba55d09d0722835bae256e2199969a272801b3976d6615fd1d2291", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955985, "uuid": "5061f85a-9869-4f6e-a38d-75ff90a89ca7", "comment": "Malware payload (Dridex)", "value": "a45edc414ae0ed48ef0b0dd4b441bdc7da696bd0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618955985, "uuid": "e07d9071-e704-4c05-90ee-e4096c3569a3", "comment": "Malware payload (Dridex)", "value": "72cb48b718d61ca23db716871832a11a8a52a3a5593404ee0f72c7bc10e8e26aeadfd450421cda6c937cc7f96a04e815", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955985, "uuid": "070eafc6-7750-4a19-aac4-efeb77a65964", "value": "58F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955985, "uuid": "c6a93938-c4d0-4cb3-bc68-5d251a423db1", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955985, "uuid": "77f6da70-ae6d-44e8-8b70-24742759a917", "value": "3072:DwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:DwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618955985, "uuid": "42ff3238-cccb-4d82-ac41-3c45df6c09e9", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618955985, "uuid": "ff9dffd2-1a87-48b5-88b3-9b7d73fea493", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618955985, "uuid": "40331f71-664a-4acd-910e-07dd50c42145", "value": "656cef7c18ba55d09d0722835bae256e2199969a272801b3976d6615fd1d2291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2244e7b9-a202-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618941561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941561, "uuid": "898deb68-cd9b-417f-97d1-3205f5d3b83b", "comment": "Malware payload (Dridex)", "value": "4ddd105af7e3c687b77c1a65f4f7a553", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941561, "uuid": "963c3ce2-15ee-4a9b-a607-a89d0882f044", "comment": "Malware payload (Dridex)", "value": "65c947999876c7e5779e9a9a79ed97c7524a11e580dba903850e89db48c21e2e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941561, "uuid": "7118b998-34ca-4c90-9130-acc6c19e9b57", "comment": "Malware payload (Dridex)", "value": "59481924275b7d400186c5c156d1cd0f26bcc21d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618941561, "uuid": "e08853c3-e5ce-47bf-ae6a-88f59cb183f9", "comment": "Malware payload (Dridex)", "value": "5a793aed5670cff1708b97bc5b4a14708da42d8d3a283c4b663e3ec73043a784acf41d3c8d5317cfc827c06f53760a25", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941561, "uuid": "b6deff09-562c-4f20-a9d2-1b13b8544d08", "value": "63F3D081E78FF451E10A6DB59CB27A2B3E31BE091689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941561, "uuid": "4c23a737-4959-4660-a5ee-fbf0a735e4a0", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941561, "uuid": "725f276b-81c3-47f9-9261-a12c8b2665d9", "value": "3072:xwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:xwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618941561, "uuid": "703c8694-8f3e-4e91-91a1-b5033e175919", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618941561, "uuid": "eec13e14-7b18-4033-8301-292d00538a25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618941561, "uuid": "4c506938-ffcc-40f2-9fa4-62c01a7929d1", "value": "65c947999876c7e5779e9a9a79ed97c7524a11e580dba903850e89db48c21e2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf887733-a225-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618956857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956857, "uuid": "8a472a5b-9b54-428d-b675-50085ca4d2dc", "comment": "Malware payload", "value": "8e611fde41bb3c3b9aadca6b3fd66901", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956857, "uuid": "bb824df2-26a0-40d0-99ef-cf6caf502250", "comment": "Malware payload", "value": "65d1767b2bb47c523c618946c22987dacc2caf5e35e5f21817bfeb352065f406", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956857, "uuid": "4aadc697-8de3-4115-a1fd-66407aa6d73c", "comment": "Malware payload", "value": "d8d057465e1d1b72f7a41b073dea0e6af60fcb74", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618956857, "uuid": "41059b7e-30fb-4773-b2d9-2b001e4a13a6", "comment": "Malware payload", "value": "fe8ef152258750e3671ae9ee6a15f787471d970fd5e256b26e7381f25a1bea4dbfc9ffa04f215a872ea9773aed38455e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956857, "uuid": "f4c2f9c0-009d-4b86-881e-f5ddaf5e389c", "value": "60F3D081E78FF451E10A6DB59CB27A2B3E31BE081689FBDBD240A90DF817175439D388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956857, "uuid": "210dcd26-2cc9-46d7-a9df-d2792bd4448c", "value": "433637d5d88b1ab11a7e5bfc30abfe93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956857, "uuid": "c565e89e-deea-4232-bc46-b295825d5c92", "value": "3072:LwZzR7ZsymCnSixFNrmGi/OFDIGJ8I04AwidV:LwZzR7ZsymHixFNrg/iUGJ8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618956857, "uuid": "7ac7206e-2a3b-4bf6-ac1e-d264f736ea00", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618956857, "uuid": "0888c69e-c259-42e3-953d-4bd66aaa5f03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618956857, "uuid": "3883652f-b981-4135-821a-36728f917afd", "value": "65d1767b2bb47c523c618946c22987dacc2caf5e35e5f21817bfeb352065f406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58843bb-a22c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618959847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959847, "uuid": "f7112ea5-1708-4215-90a4-1d3b88fc58cc", "comment": "Malware payload", "value": "a54cb55501847a85499220bed1461aff", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959847, "uuid": "b0809b53-1236-469f-b9f8-8f56605e24ce", "comment": "Malware payload", "value": "6688d261a735a6d2ce533bf14e8f7ab922e552341f51145ac8c46d70dfbdef93", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959847, "uuid": "2f211b49-433e-4b33-b77d-54d5a83becfe", "comment": "Malware payload", "value": "174d58fb3a8d76b70d729edee8a56e7361bea127", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618959847, "uuid": "ac92a630-cdd0-4677-989e-c6b8fbf3243a", "comment": "Malware payload", "value": "ccb568fd5e93deba90d8b59bab25739b2f76b1fcd2214d9474287c76c54aed5f983479377c73f4204da1bd0d457fd2cb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959847, "uuid": "a847a0c2-6ff2-4d95-a032-d11307cfac92", "value": "EBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959847, "uuid": "b5e69df5-9830-421e-b93f-b6f7ebb10231", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618959847, "uuid": "6e9a3b6d-2c9c-4ba5-a9bc-da1ea6437a85", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618959847, "uuid": "007d4910-993b-4822-bf4a-63a41f7e7815",